Email fraud and VPN exposure are driving 2025 claims risk

At a glance

What this is: At-Bay’s claims analysis says email fraud and remote access tools dominated loss patterns in 2024, with email and VPN exposure driving much of the report’s risk signal.

Why it matters: It matters because IAM, PAM, and security teams have to treat email-based payment manipulation and remote access governance as business-critical control problems, not isolated tool issues.

By the numbers:

• The report says email and remote access tools together accounted for roughly 60% of all At-Bay claims in 2024.
• Email-based claims accounted for 43% of all incidents in 2024.

Context

Email security and remote access governance fail in different ways, but both create the same outcome when they are treated as routine infrastructure instead of controlled attack surfaces. In this report, At-Bay ties claims loss to two pressure points that many programmes still undermanage: business email compromise and exposed remote access paths.

The identity angle is direct. Email fraud depends on human trust and delegated payment authority, while VPN abuse depends on remote access identities, device trust, and patch discipline. The control problem is not just tooling, but whether the organisation can verify intent, authenticate access, and limit blast radius across remote access identity.

Key questions

Q: How can organisations reduce the risk of request-based fraud through email?

A: Organisations should require extra verification for sensitive requests that arrive by email, especially when they involve money movement, credential changes, or privilege escalation. The key is to make the approval path depend on independent identity checks, not just on the email thread. That reduces the chance that a believable message becomes an authorised action.

Q: Why do exposed VPN and firewall appliances create ransomware blast radius problems?

A: Exposed VPN and firewall appliances often sit at the junction of remote access and administrative trust, so compromise there gives attackers both connectivity and identity leverage. Once they can alter appliance configuration or reuse admin sessions, they can pivot into internal systems with little friction. That makes appliance hardening and account governance inseparable.

Q: What are the signs that remote access controls are not working as intended?

A: Warning signs include vulnerable endpoints, misconfigured remote access systems, users reaching sensitive data they do not need, and audit findings that show policies are not being followed. Repeated incidents, weak password enforcement, and poor response to anomalies also indicate control failure. If access cannot be verified, reviewed, and constrained centrally, the remote access programme is probably drifting outside its intended security boundary.

Q: What should teams do when email fraud and remote access abuse are both driving losses?

A: Treat them as connected trust problems and coordinate finance controls, identity verification, remote access policy, and incident response. The practical goal is to reduce the attacker’s ability to move from trusted communication into trusted access, then from access into encryption or payment loss.

Technical breakdown

Why email fraud now bypasses traditional phishing controls

Modern business email compromise often succeeds without malware, links, or attachments. Instead, attackers use clean, context-aware language to impersonate invoices, payment changes, and executive requests. That makes the failure mode less about malicious payload detection and more about trust abuse inside normal business workflows. Traditional secure email gateways are built to inspect obvious indicators, but they struggle when the message itself is the weapon. The governance gap is that payment workflows still assume email authenticity is sufficient proof of intent, which is no longer true.

Practical implication: Practitioners should move payment-change verification out of email and into an out-of-band approval process.

Why VPN appliances create a concentrated remote access risk

On-premise VPN appliances expose a stable external entry point that attackers can probe, exploit, or inherit once credentials are compromised. They also concentrate authentication, patching, and exposure management into a single control surface, which means any delay in remediation raises organisational risk. In practice, VPNs become a high-value remote access identity boundary, especially when MFA, device posture, and monitoring are inconsistent. The problem is not remote access itself, but the persistence of a permanent front door that is difficult to shrink or segment. See the Remote Access Identity Guide.

Practical implication: Teams should treat VPNs as high-risk access infrastructure and reduce standing exposure wherever possible.

How managed detection changes ransomware outcomes after initial access

Ransomware cases in the report show a recurring pattern: initial access is not the only variable, because whether encryption happens often depends on how quickly defenders detect and contain the intrusion. Managed detection and response matters when alert volume, analyst coverage, and response speed determine whether an intruder can move from access to impact. This is especially relevant where remote access and identity compromise provide a fast route into the environment. The architectural issue is not just endpoint tooling, but whether detection is tied to operational action. See the Cloud Credential Compromise Playbook.

Practical implication: Security teams should verify that detection, triage, and containment are staffed and exercised around the clock.

Threat narrative

Attacker objective: The attacker wants to convert trusted business communication or remote access into financial loss, ransomware deployment, or both.

1. Entry commonly begins with email-based social engineering that looks like routine invoice or payment correspondence.
2. Credential or trust abuse follows when a recipient accepts the message as legitimate and changes payment or access workflows.
3. Escalation occurs through remote access abuse when exposed VPN appliances or weakly governed access paths provide a route deeper into the environment.
4. Impact is ransomware encryption, fraudulent wire transfer loss, or both, depending on which trust path the attacker exploited.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Email fraud is now a governance problem, not a filter problem. The report’s core message is that modern business email compromise is built to survive traditional phishing detection because it looks like ordinary business language. That shifts responsibility from message screening alone to payment authority controls, approval design, and user verification. Email security programmes that still rely on obvious indicators are solving the previous generation of fraud. Practitioners should treat invoice and payment workflows as identity-bound trust processes.

Remote access appliances have become concentrated identity risk points. The Cisco and Citrix VPN finding is not really about brands, but about the operational reality of exposed access infrastructure. When remote access is anchored to a permanent perimeter entry point, patch delay and credential abuse both become high-impact failure modes. The report reinforces that authentication strength alone is not enough when the access surface itself remains broad. Practitioners should reduce standing exposure and redesign remote access boundaries.

Managed response is the difference between intrusion and impact. The report shows that tooling alone did not prevent ransomware encryption, but properly managed detection and response did change outcomes. That is a programme maturity issue, not a product issue. Security teams that cannot monitor, triage, and act in minutes are effectively ceding the decisive part of the attack chain to the intruder. Practitioners should measure whether response coverage is operational, not assumed.

Email and remote access are now part of the same attack economy. Attackers increasingly move between trust abuse in email and trust abuse in access pathways because both exploit ordinary business behaviour. That means identity governance, email security, and remote access governance can no longer operate as separate workstreams. The named concept here is trust-path convergence: when the same attacker playbook targets both communication trust and access trust, controls must be coordinated. Practitioners should align email verification, remote access policy, and incident response around that shared threat model.

What this signals

Trust-path convergence: email fraud and remote access abuse are increasingly part of the same operational risk picture, which means security teams should stop managing them as separate towers. The control objective is to break the attacker’s ability to move from trusted message to trusted access to business impact.

The report also signals a shift in control design: prevention matters, but verification and response matter just as much when attackers use legitimate channels. For practitioners, the next step is to align finance approval workflows, remote access governance, and monitoring coverage so that one weak trust path does not invalidate the rest of the programme.

For practitioners

• Implement out-of-band verification for payment changes Require voice or in-person confirmation for any request to change banking details, redirect invoices, or alter payment destinations. Make the control mandatory for finance teams and any employee who can approve payments.
• Harden remote access before migrating off VPN If you still rely on on-premise VPN appliances, ensure they are fully patched, protected with enterprise MFA, and monitored continuously while you plan a move to less exposed access patterns.
• Review email security for context-aware fraud detection Test whether your email stack can detect conversation drift, payment manipulation, and socially engineered requests that do not contain links or attachments. Traditional malware and URL blocking is not enough.
• Validate 24/7 managed response coverage Confirm that alerts are being watched continuously and that containment can happen in minutes, not hours or days. If no one is actively triaging and responding, EDR or MDR is not functioning as a control.

Key takeaways

• The report shows that modern fraud and remote access abuse now exploit trusted business processes rather than only technical vulnerabilities.
• Its evidence ties a large share of claims loss to email and remote access, with VPN exposure standing out as a ransomware risk multiplier.
• Practitioners should strengthen out-of-band verification, tighten remote access governance, and confirm that monitoring and response are truly operational.

Related NHI Mgmt Group resources: Remote Access Identity Guide · Cloud Credential Compromise Playbook · Cloud Workload Identity Guide · RMM Tool Security Guide

Key terms

• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Secure Access Service Edge: SASE is a converged architecture that combines network connectivity with security controls such as zero trust access, secure web gateway, and firewall services. It is useful for consistent enforcement across distributed environments, but it does not replace identity governance or entitlement ownership.
• Managed Detection And Response: MDR is a service model focused on detecting suspicious activity, investigating alerts, and helping contain attacks across threat-facing technologies. It is designed to turn telemetry into action, which makes it closer to security operations than simple platform administration.
• Remote Access Identity: Remote access identity is the trust relationship used when a person or workload connects from outside the internal network. In practice, it combines authentication strength, device or session assurance, and the permissions granted after login, which makes it a high-risk control point for credential abuse.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, workload identity, and the access control principles that underpin remote access security. It helps identity and security teams connect governance decisions to the controls that reduce real-world exposure.