TL;DR: Two cyber risks, remote access tools and social engineering over email, drove about 60% of all insured claims in 2024, according to At-Bay, while 80% of ransomware attacks involved remote access tools and 83% of those used VPN devices. The insurance model is shifting from one-time assessment toward continuous technical data, because static questionnaires and scans miss how quickly attack paths change.
At a glance
What this is: At-Bay’s fireside chat argues that cyber insurance is moving toward continuous, data-driven risk management as remote access abuse and email fraud dominate loss patterns.
Why it matters: This matters to IAM, PAM, NHI, and security teams because the controls insurers are now pricing against are the same access paths attackers exploit, especially remote access, VPNs, and email-based trust.
By the numbers:
- Remote access tools and social engineering over email account for about 60% of all At-Bay insured claims in 2024.
- In 2024, 80% of ransomware attacks involved remote access tools.
- 83% of those ransomware attacks specifically involved VPN devices.
- At-Bay says it identifies fraud attempts against 30% of its insureds each month that email security tools do not catch.
Context
Cyber risk is no longer shaped by a single control failure or a single technology category. It is shaped by how remote access, email trust, identity verification, and attack speed interact across the whole environment, and that makes static risk assessment less reliable than continuous telemetry.
In this article, At-Bay treats insurance as part of the security control loop rather than a pure transfer mechanism. That framing matters for practitioners because the useful question is not whether a tool exists, but whether it meaningfully reduces exposure in the paths attackers actually use.
Key questions
Q: What should organisations do first when remote access tools are driving cyber claims?
A: Start by mapping every internet-facing remote access path, then verify patch status, authentication strength, and logging coverage. If a VPN or gateway can reach critical systems, treat it as a privileged access channel and reduce unnecessary standing exposure before you optimise for convenience or scale.
Q: Why do legitimate remote-support tools create such high ransomware risk?
A: Because they provide durable, interactive access that looks like ordinary IT support. Attackers prefer them over custom malware since they survive reboots, blend into normal admin activity, and can be used later for credential theft or lateral movement. The risk rises when installation rights and session controls are not tightly governed.
Q: What are the signs that an email fraud defence program is not working well enough?
A: A weak program usually shows up as repeated spoofing attempts, frequent impersonation of multiple identities, and a steady stream of urgent payment or request emails that reach users unchallenged. If finance, HR, and accounts payable are all being targeted, the organisation is likely seeing attackers move beyond single executive spoofing. That pattern means controls are not stopping reconnaissance, impersonation, or workflow abuse.
Q: Should insurers and security teams use continuous evidence instead of questionnaires alone?
A: Yes. Questionnaires are useful for governance, but they cannot show whether exposure, authentication, or email risk has changed since the last review. Continuous evidence helps both insurers and defenders price and prioritise the controls that actually reduce loss, rather than the controls that only look good on paper.
Technical breakdown
Why remote access tools create a durable attack path
Remote access tools compress the distance between an attacker and an internal environment, which is why they remain attractive for ransomware operators. VPNs, remote desktop gateways, and other access brokers often become high-value targets because a compromise there can turn one foothold into broad internal reach. The risk is not just the technology itself, but the trust placed in that access path once authentication succeeds. In practice, defenders need to think about exposure, patch velocity, and session control together rather than as separate problems. See the [[L6|workforce identity security]] guide. See the Workforce Identity Security Guide.
Practical implication: Treat remote access as a governed identity path, not just a connectivity layer, and reduce the standing trust attached to it.
Why email fraud often bypasses traditional security controls
Email fraud succeeds because it exploits human trust and business process trust at the same time. Traditional security tools can filter known malicious content, but they often miss well-timed impersonation, invoice redirection, vendor spoofing, and conversation hijacking that looks legitimate in transit. That is why fraud teams increasingly need signals from identity, finance, and communications workflows, not just gateway inspection. The control problem is broader than spam filtering: it is about verifying intent before payment or account changes are approved. See the [[L5|threat intelligence]] guide. See the Threat Intelligence Guide.
Practical implication: Add verification steps to financial and admin workflows so message authenticity is checked before action is taken.
Why continuous risk scoring is replacing questionnaire-only underwriting
Questionnaires and point-in-time scans describe intent and configuration, but they do not capture how an environment changes between review cycles. Continuous underwriting relies on live technical indicators, such as exposed services, authentication strength, telemetry from security tools, and patterns of user-facing risk. That shift is important because many breach drivers are dynamic, especially where remote access, identity abuse, and externally exposed services are involved. The underwriting model is moving toward evidence that can be refreshed, compared, and operationalised, rather than self-attestation alone.
Practical implication: Use continuously refreshed control evidence when you decide whether a risk posture is actually improving.
Threat narrative
Attacker objective: The attacker aims to convert trusted access into operational disruption, fraud, or ransomware impact before the organisation can revalidate the session or workflow.
- Entry occurs through vulnerable remote access infrastructure or through a successful email-based fraud or impersonation attempt.
- Credentialed access or trusted communication is then abused to reach internal systems, initiate ransomware activity, or divert funds and sensitive data.
- Impact follows when attackers exploit the trusted path faster than defenders can detect, verify, and contain the abuse.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Continuous risk governance is becoming the real control layer: point-in-time questionnaires cannot keep pace with attack conditions that change daily. When remote access exposure and email fraud drive loss, the meaningful control is not the annual assessment cycle but the ability to measure and react to live exposure. Practitioners should treat control evidence as operational telemetry, not paperwork.
Email trust is now an identity problem as much as a security problem: fraud succeeds when people accept a message, request, or payment instruction as authentic without independent verification. That makes the boundary between human identity, business process identity, and communication security much thinner than many programmes assume. Security teams need to govern approval paths, not just mail filters.
Remote access concentration creates a high-value control surface: the more business processes depend on VPNs, remote gateways, and externally reachable access tools, the more those controls resemble privileged identities. A single compromise can become broad internal access, which is why access architecture, patching discipline, and session governance must be managed together. Workforce identity security is relevant here because access paths are now part of the identity perimeter.
Insurance is acting as a market pressure mechanism on security design: the article shows how risk pricing is increasingly linked to technical evidence, not just declared policy. That creates a stronger incentive for organisations to prove control effectiveness continuously. Practitioners should expect insurers and brokers to ask better technical questions and to reward measurable reduction in exposure.
New concept, continuous exposure pricing: the article describes a market in which risk is priced against live technical posture rather than static declarations. That shifts pressure onto defenders to keep access, email, and endpoint signals current enough to reflect real attack conditions. Practitioners should assume underwriting and control assurance are converging.
What this signals
Continuous exposure pricing: insurance and security are converging around live control evidence, which means static attestations will carry less weight in both underwriting and internal governance. Practitioners should expect more demand for measurable access posture, authentication strength, and exposure monitoring.
The deeper change is that loss modelling is moving closer to identity and access operations. If remote access tools, email workflows, and privileged channels are the main pathways to claims, then security programmes will be judged by whether they can reduce those pathways continuously rather than periodically.
For practitioners
- Strengthen controls around remote access gateways Inventory every externally reachable remote access path, confirm patch status, and reduce unnecessary standing exposure on VPNs and related tools.
- Add verification to finance-facing email workflows Require out-of-band confirmation for payment changes, bank-detail updates, and vendor requests that arrive by email.
- Replace one-time assessments with continuous evidence Use live telemetry from security tools, exposure scans, and authentication signals to refresh cyber risk decisions regularly.
- Separate underwriting assumptions from operational reality Compare declared controls against actual exposure and loss events so risk decisions reflect how systems behave today, not last quarter.
Key takeaways
- The article links rising claim frequency to attack paths that are already familiar to IAM and security teams, especially remote access and email-based fraud.
- The evidence points to concentration risk, with remote access involved in most ransomware activity described here and email fraud outpacing ransomware in some loss patterns.
- The practical response is continuous control validation, especially for remote access exposure, identity-driven approvals, and risk evidence that stays current between review cycles.
Related NHI Mgmt Group resources: Workforce Identity Security Guide · Threat Intelligence Guide · Cyber Insurance Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Remote access risk in the article is fundamentally about how access is granted and governed. |
| Recommendation — Apply PR.AA-05 to tighten remote access entitlements and remove unnecessary standing access paths. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article centres on account and access paths that attackers abuse through remote tools and email fraud. |
| Recommendation — Use CIS-5 to inventory, review, and disable accounts tied to exposed remote access services. | ||
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | The loss patterns described align with credential-driven intrusion followed by ransomware impact. |
| Recommendation — Map remote access abuse and ransomware loss patterns to TA0006 and TA0040 in your threat detection work. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article’s remote access and fraud themes depend on how authenticators are issued and protected. |
| AC-6 — Least Privilege | Privileged remote access becomes more dangerous when accounts and tools carry excessive rights. | |
| Recommendation — Use IA-5 to govern credential lifecycle, especially for remote access and privileged authentication. Apply AC-6 to reduce privilege on remote access pathways and limit blast radius after compromise. | ||
Key terms
- Remote Access Exposure: Remote access exposure is the risk created when internet-facing access services are left vulnerable, over-permissioned, or insufficiently monitored. In ransomware incidents, these services often become the first foothold, especially when attackers can exploit weak authentication, unpatched gateways, or legacy protocols to enter a network.
- Email Fraud: Email fraud is the use of deceptive messages to impersonate trusted senders and trick recipients into taking harmful action. It commonly includes business email compromise, account takeover, and spoofed brand communication, and it succeeds when authentication controls, user awareness, and operational feedback loops are weak.
- Continuous Risk Scoring: Continuous risk scoring assigns and updates an identity risk value as behaviour, entitlements, location, and privilege level change. It gives security teams a prioritisation mechanism for access decisions, but it only works when the score is tied to a clear governance action.
- Exposure-Driven Underwriting: Exposure-driven underwriting is a risk pricing approach that weights current technical conditions more heavily than declared posture. It relies on real indicators such as patch state, authentication strength, and observable attack surface to estimate how likely a loss event is to occur.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect access governance, secrets, and privilege to real operational risk.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org