Topic starter
24/10/2026 8:52 pm
TL;DR: $221K shows cyber claims now stack beyond the initial incident in At-Bay’s survey data. Incident response, recovery, and legal readiness now affect total loss as much as the attack itself.
Editorial analysis by NHI Mgmt Group, based on content published by At-Bay: “5 Key Findings From the InsurSec Report — and What You Can Do About Them”.
By the numbers:
- Average claim severity climbed to an all-time high of $221K.
- Akira attacks made up more than 40% of all ransomware claims in At-Bay’s portfolio for the full year.
- When At-Bay was notified of a fraud incident within three days, policyholders recovered some funds 70% of the time.
Key questions
Q: Why does fraud loss become harder to recover after the first few hours?
A: Because money movement quickly becomes irreversible once it leaves the original account path.
Q: What are the signs that a cyber incident is turning into business interruption?
A: The warning signs are not only encryption prompts.
Q: What breaks when ransomware attackers can reach backup systems and email archives?
A: When attackers can reach backup systems and email archives, the breach stops being a single data loss event and becomes a full intelligence harvest.
Practitioner guidance
- Implement 24/7 monitoring for exposed remote access Treat VPN appliances, firewall portals, and other perimeter access points as high-risk entry paths.
- Separate backup systems from primary network access Keep backup storage logically isolated, immutable where possible, and monitored for probing or deletion attempts.
- Pre-approve fraud escalation ownership Assign named owners for suspicious payment activity, define who contacts insurers or banks, and make the first external escalation action immediate rather than subject to internal review.
Bottom line: At-Bay’s report shows that cyber incidents now create layered losses, not just a single event cost, because operational disruption, fraud, and litigation can follow the initial compromise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:13 am
Cost containment has become an access governance problem, not just an insurance problem. The report shows that the largest losses appear when attackers can keep moving after entry, whether that means encryption, fraud, or legal fallout. That makes the quality of access control, escalation paths, and detection coverage central to financial outcome. For identity teams, the implication is clear: privileged access governance is now a loss-mitigation control, not only an administrative one.
A question worth separating out:
Q: How should organisations prepare for lawsuits after a cyber incident?
A: They should treat evidence preservation, notification records, and legal coordination as part of incident response from the outset. If those materials are missing or inconsistent, later claims and class actions become harder to defend. Preparation also means involving legal counsel early enough to shape the record, not merely react to it.
👉 Read our full editorial: InsurSec losses now compound after the initial cyber incident
This post was modified 6 days ago by NHI Mgmt Group