Cyber-risks are a significant and mounting threat for business, and thus pose a challenge for insurance companies to underwrite and mitigate in their portfolios. Employee behavior constitutes a critical vulnerability in this area. At the same time, employees are a vital defense mechanism. Unfortunately, the tools currently available to impact employee behavior are still underdeveloped. In this article, we share the results of our research and provide useful insights for companies and insurers to evaluate and mitigate these behavioral cyber vulnerabilities. Leveraging proven customer analysis tools as well as risk and crisis communication tools, we propose that awareness, responsibility and fallibility drive cyber-risk behavior. Further, mitigation measures need to be co-developed with employees, go beyond normative training, and drive employee actions in order to influence their cyber-risk behavior.