Cyber insurance risk is changing: what practitioners need to act on

TL;DR: Two cyber risks, remote access tools and social engineering over email, drove about 60% of all insured claims in 2024, according to At-Bay, while 80% of ransomware attacks involved remote access tools and 83% of those used VPN devices. The insurance model is shifting from one-time assessment toward continuous technical data, because static questionnaires and scans miss how quickly attack paths change.

Editorial analysis by NHI Mgmt Group, based on content published by At-Bay: “New Threats, New Tech: How Innovation Is Redefining Cyber Risk”.

By the numbers:

• Remote access tools and social engineering over email account for about 60% of all At-Bay insured claims in 2024.
• In 2024, 80% of ransomware attacks involved remote access tools.
• 83% of those ransomware attacks specifically involved VPN devices.

Key questions

Q: What should organisations do first when remote access tools are driving cyber claims?

A: Start by mapping every internet-facing remote access path, then verify patch status, authentication strength, and logging coverage.

Q: Why do legitimate remote-support tools create such high ransomware risk?

A: Because they provide durable, interactive access that looks like ordinary IT support.

Q: What are the signs that an email fraud defence program is not working well enough?

A: A weak program usually shows up as repeated spoofing attempts, frequent impersonation of multiple identities, and a steady stream of urgent payment or request emails that reach users unchallenged.

Practitioner guidance

• Strengthen controls around remote access gateways Inventory every externally reachable remote access path, confirm patch status, and reduce unnecessary standing exposure on VPNs and related tools.
• Add verification to finance-facing email workflows Require out-of-band confirmation for payment changes, bank-detail updates, and vendor requests that arrive by email.
• Replace one-time assessments with continuous evidence Use live telemetry from security tools, exposure scans, and authentication signals to refresh cyber risk decisions regularly.

Bottom line: The article links rising claim frequency to attack paths that are already familiar to IAM and security teams, especially remote access and email-based fraud.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →