At-Bay’s InsurSec findings: what do they mean for cyber risk teams?

TL;DR: Claims severity hit $221K, ransomware frequency returned to 2021 levels, and financial fraud averaged $285K stolen as losses increasingly compounded after the initial incident, according to At-Bay’s 2026 InsurSec Report. The lesson is that detection, escalation, resilience, and legal readiness now shape total loss as much as the attack itself.

Editorial analysis by NHI Mgmt Group, based on content published by At-Bay: “5 Key Findings From the InsurSec Report — and What You Can Do About Them”.

By the numbers:

• Average claim severity climbed to an all-time high of $221K.
• Akira attacks made up more than 40% of all ransomware claims in At-Bay’s portfolio for the full year.
• When At-Bay was notified of a fraud incident within three days, policyholders recovered some funds 70% of the time.

Key questions

Q: What breaks when ransomware attackers can reach backup systems and email archives?

A: When attackers can reach backup systems and email archives, the breach stops being a single data loss event and becomes a full intelligence harvest.

Q: Why does fraud loss become harder to recover after the first few hours?

A: Because money movement quickly becomes irreversible once it leaves the original account path.

Q: What are the signs that a cyber incident is turning into business interruption?

A: The warning signs are not only encryption prompts.

Practitioner guidance

• Implement 24/7 monitoring for exposed remote access Treat VPN appliances, firewall portals, and other perimeter access points as high-risk entry paths.
• Separate backup systems from primary network access Keep backup storage logically isolated, immutable where possible, and monitored for probing or deletion attempts.
• Pre-approve fraud escalation ownership Assign named owners for suspicious payment activity, define who contacts insurers or banks, and make the first external escalation action immediate rather than subject to internal review.

Bottom line: At-Bay’s report shows that cyber incidents now create layered losses, not just a single event cost, because operational disruption, fraud, and litigation can follow the initial compromise.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →