Email fraud and VPN exposure: what security teams need to act on

TL;DR: Email attacks and remote access tools accounted for roughly 60% of all claims in 2024, while VPN users faced sharply higher ransomware risk, according to At-Bay’s 2025 InsurSec Rankings Report, based on more than 100,000 policy years of cyber insurance claims. The pattern shows that modern fraud and remote access exposure now demand stronger identity verification, monitoring, and control of entry paths.

Editorial analysis by NHI Mgmt Group, based on content published by At-Bay: “6 Key Findings from the 2025 InsurSec Rankings Report (and What Businesses Can Do About Them)”.

By the numbers:

• The report says email and remote access tools together accounted for roughly 60% of all At-Bay claims in 2024.
• Email-based claims accounted for 43% of all incidents in 2024.

Key questions

Q: How can organisations reduce the risk of request-based fraud through email?

A: Organisations should require extra verification for sensitive requests that arrive by email, especially when they involve money movement, credential changes, or privilege escalation.

Q: Why do exposed VPN and firewall appliances create ransomware blast radius problems?

A: Exposed VPN and firewall appliances often sit at the junction of remote access and administrative trust, so compromise there gives attackers both connectivity and identity leverage.

Q: What are the signs that remote access controls are not working as intended?

A: Warning signs include vulnerable endpoints, misconfigured remote access systems, users reaching sensitive data they do not need, and audit findings that show policies are not being followed.

Practitioner guidance

• Implement out-of-band verification for payment changes Require voice or in-person confirmation for any request to change banking details, redirect invoices, or alter payment destinations.
• Harden remote access before migrating off VPN If you still rely on on-premise VPN appliances, ensure they are fully patched, protected with enterprise MFA, and monitored continuously while you plan a move to less exposed access patterns.
• Review email security for context-aware fraud detection Test whether your email stack can detect conversation drift, payment manipulation, and socially engineered requests that do not contain links or attachments.

Bottom line: The report shows that modern fraud and remote access abuse now exploit trusted business processes rather than only technical vulnerabilities.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →