TL;DR: Claims severity hit $221K, ransomware frequency returned to 2021 levels, and financial fraud averaged $285K stolen as losses increasingly compounded after the initial incident, according to At-Bay’s 2026 InsurSec Report. The lesson is that detection, escalation, resilience, and legal readiness now shape total loss as much as the attack itself.
At a glance
What this is: At-Bay’s 2026 InsurSec Report argues that incident costs now extend well beyond the initial attack, with ransomware, fraud, downtime, and litigation all compounding losses.
Why it matters: It matters because identity, access, response, and resilience controls increasingly determine how far an incident spreads and how expensive recovery becomes.
By the numbers:
- Claim frequency rose 7% year-over-year to the highest rate At-Bay has recorded since 2021.
- Average claim severity climbed to an all-time high of $221K.
- Akira attacks made up more than 40% of all ransomware claims in At-Bay’s portfolio for the full year.
- When At-Bay was notified of a fraud incident within three days, policyholders recovered some funds 70% of the time.
Context
At the core of this report is a governance problem that many programmes still underweight: the loss profile of an incident is not fixed at first compromise. The cost evolves through containment speed, backup integrity, fraud escalation, operational downtime, and whether legal exposure is handled as part of response rather than after the fact.
For identity and access teams, the report is relevant because the attack paths described here depend on privileged access, exposed remote access, weak operational monitoring, and delayed escalation. That makes it directly relevant to NHI governance, privileged access control, incident response, and resilience planning, not just cyber insurance.
The pattern is typical of modern incidents rather than exceptional. Once attackers can move quickly, reach critical systems, or convert funds before escalation, the control gap is no longer just prevention but the organisation’s ability to compress the incident timeline.
Key questions
Q: What breaks when ransomware attackers can reach backup systems and email archives?
A: When attackers can reach backup systems and email archives, the breach stops being a single data loss event and becomes a full intelligence harvest. Historical mail, backups, and recovery stores often contain credentials, org charts, and sensitive context that support follow-on phishing, impersonation, and broader extortion.
Q: Why does fraud loss become harder to recover after the first few hours?
A: Because money movement quickly becomes irreversible once it leaves the original account path. As funds are transferred onward, converted, or routed through intermediaries, banks and insurers have less time to freeze or claw them back. Rapid escalation is therefore part of the control, not just the response.
Q: What are the signs that a cyber incident is turning into business interruption?
A: The warning signs are not only encryption prompts. They include loss of access to key systems, disruption to payment or production dependencies, backup tampering, and delayed restoration progress. When those appear together, the incident has moved from intrusion to operational outage and must be managed as a continuity event.
Q: How should organisations prepare for lawsuits after a cyber incident?
A: They should treat evidence preservation, notification records, and legal coordination as part of incident response from the outset. If those materials are missing or inconsistent, later claims and class actions become harder to defend. Preparation also means involving legal counsel early enough to shape the record, not merely react to it.
Technical breakdown
Why incident cost keeps rising after the first compromise
Cyber loss rarely stops at initial access. Once attackers are inside, the cost curve is shaped by how fast they can move, whether critical systems are protected, and how quickly the organisation detects and contains activity. That is why ransomware, fraud, and litigation appear in the same report as separate loss drivers. The technical reality is that the operational blast radius expands when access, monitoring, and escalation are not aligned. In practice, the incident timeline becomes a control timeline: the longer malicious activity persists, the more expensive the outcome becomes.
Practical implication: Measure security by containment speed and blast-radius reduction, not only by whether an intrusion occurred.
How ransomware turns into business interruption
Ransomware is not just an encryption event. In many cases, attackers first enumerate the environment, escalate privileges, identify backups, and prepare the impact phase before deployment. Business interruption occurs when those preparatory stages succeed against systems the organisation cannot quickly replace. That is why backup isolation, failover design, and detection around critical dependencies matter. The point is not only to prevent encryption but to stop the attacker from neutralising recovery paths before business operations are affected.
Practical implication: Treat backup systems and failover paths as high-value assets that require separate monitoring and protection.
Why fraud response has to be measured in hours
Financial fraud becomes much harder to unwind once funds move through banking channels or are converted into other stores of value. The operational challenge is not only identifying suspicious activity but escalating it fast enough for traceability and clawback actions to begin. That makes employee awareness, decision ownership, and external notification procedures part of security control, not just finance process. Delay creates irreversible movement, and irreversibility is what attackers count on.
Practical implication: Pre-assign fraud escalation authority so the first call happens immediately when suspicious transfers appear.
Threat narrative
Attacker objective: The attacker’s objective is to convert initial access into maximum financial damage by forcing recovery costs, interrupting operations, or irreversibly moving funds.
- Entry occurs through exposed infrastructure, weak remote access, or a trusted workflow that attackers can reach faster than defenders can respond.
- Escalation follows as attackers seek privileged access, move through systems, identify backups, or prepare fraudulent transfers before detection.
- Impact arrives as ransomware encryption, unrecoverable fund movement, downtime, or downstream litigation that extends the incident cost curve.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Cost containment has become an access governance problem, not just an insurance problem. The report shows that the largest losses appear when attackers can keep moving after entry, whether that means encryption, fraud, or legal fallout. That makes the quality of access control, escalation paths, and detection coverage central to financial outcome. For identity teams, the implication is clear: privileged access governance is now a loss-mitigation control, not only an administrative one.
Business interruption exposes the failure of recovery design. When ransomware can remove not only primary systems but also backup viability, the organisation’s technical resilience was never complete. The report’s emphasis on downtime shows that operational continuity depends on segmented recovery paths, immutable backups, and monitoring around critical dependencies. Practitioners should treat failover design as part of security architecture, because recovery that cannot survive attacker reconnaissance is not resilience.
Financial fraud introduces a time-to-escalation control gap that many organisations still under-specify. The report’s recovery data shows that the first hours after suspicious transfer activity are decisive. That reveals a governance assumption that internal review can happen before external action, which is often false once funds leave the environment. Practitioners should design fraud escalation as a rapid-response workflow with named owners and pre-agreed external contacts.
Litigation is now part of the incident lifecycle. Cyber programmes that stop at containment and restoration ignore the fact that claims, disclosure, and class actions can extend the loss window by months or years. That changes what maturity looks like: teams need evidence preservation, legal coordination, and logging discipline from the start of the incident. The practitioner conclusion is that incident response must be built to withstand later scrutiny, not only immediate recovery.
Blast-radius control is emerging as the defining cyber governance concept. The report repeatedly shows that organisations lose less when they compress attacker dwell time, preserve recovery options, and force rapid escalation. That means the practical measure of control quality is no longer just prevention at the perimeter. It is how much damage the environment allows before defenders can reassert control.
What this signals
Blast-radius control now matters more than incident labels. Whether the event is ransomware, fraud, or a data breach, the practical question is how much damage can happen before containment starts. Identity and access programmes should therefore be judged by their ability to limit privilege spread, shorten escalation paths, and preserve recovery options.
The report reinforces a governance shift from prevention-only to response-ready design. Organisations that still separate access control, resilience, and response management are carrying avoidable loss exposure. For IAM and PAM teams, that means aligning privileged access governance with incident response, backup protection, and fraud escalation workflows.
Delayed escalation is a recurring failure mode. The report’s fraud findings show that recovery odds fall when action waits on internal review, and the same logic applies to cyber incidents more broadly. Security programmes need predefined ownership, clear thresholds, and routing that bypasses ambiguity when the clock starts running.
For practitioners
- Implement 24/7 monitoring for exposed remote access Treat VPN appliances, firewall portals, and other perimeter access points as high-risk entry paths. Monitor them outside business hours and ensure alerts reach responders who can act immediately when compromise patterns emerge.
- Separate backup systems from primary network access Keep backup storage logically isolated, immutable where possible, and monitored for probing or deletion attempts. Recovery paths should survive attacker reconnaissance, not just routine outage scenarios.
- Pre-approve fraud escalation ownership Assign named owners for suspicious payment activity, define who contacts insurers or banks, and make the first external escalation action immediate rather than subject to internal review.
- Add legal and evidence handling to incident response Preserve logs, notifications, and decision records from the start of an incident so that later claims, subpoenas, or class actions do not depend on incomplete reconstruction.
Key takeaways
- At-Bay’s report shows that cyber incidents now create layered losses, not just a single event cost, because operational disruption, fraud, and litigation can follow the initial compromise.
- The report’s data links faster escalation and stronger recovery design to materially better outcomes, including higher fraud recovery rates and reduced ransomware impact.
- Security teams should treat access governance, backup isolation, and response ownership as financial controls because they directly influence how much damage an attacker can sustain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0004; TA0006; TA0008; TA0040 — Privilege Escalation; Credential Access; Lateral Movement; Impact | The report describes attacker movement, privilege use, and operational impact across ransomware and fraud cases. |
| Recommendation — Map observed incident patterns to these tactics and prioritise detections that interrupt privilege use and impact delivery. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Access scope and entitlement control are central to the report’s loss-reduction logic. |
| Recommendation — Review entitlement governance so critical systems and recovery paths have tightly bounded access. | ||
| CIS Controls v8 | CIS-5 — Account Management | The report repeatedly shows that account control and escalation ownership influence incident cost. |
| Recommendation — Harden account lifecycle controls so privileged and operational accounts can be revoked or escalated quickly. | ||
| NIST SP 800-53 Rev 5 | IR-4 — Incident Handling | The article emphasises fast escalation, response coordination, and containment under pressure. |
| CP-9 — System Backup | Backup resilience is the difference between containment and prolonged business interruption. | |
| Recommendation — Align incident handling procedures with fraud, ransomware, and legal response workflows. Protect backups with separation, immutability, and recovery validation before attackers can target them. | ||
Deepen your knowledge
NHI Mgmt Group’s NHI Foundation Level course covers NHI governance, machine identity security, and secrets management in a practical, practitioner-led format, within the industry's only accredited NHI security programme. It helps security leaders connect identity controls to resilience, incident response, and operational risk.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org