Topic starter
24/10/2026 8:49 pm
TL;DR: Ransomware and fraud losses are concentrating in SMBs using on-premise VPNs, with remote access tools serving as the initial entry vector for 80% of its ransomware claims and some incidents reaching full encryption in under one hour, according to At-Bay. Precision rate deployment, not blanket pricing, is becoming the more defensible response.
Editorial analysis by NHI Mgmt Group, based on content published by At-Bay: “The Cyber Insurance Market Needs Rate, but Rate Alone Won’t Solve the SMB Cyber Problem”.
Key questions
Q: What fails when an SMB relies on an on-premise VPN without strong governance?
A: The failure is not the VPN alone.
Q: Why do on-premise VPNs drive higher ransomware losses than cloud-based remote access?
A: On-premise VPNs often combine exposed infrastructure, broad network reach, and delayed maintenance, which gives attackers a shorter path from entry to impact.
Q: How can security teams tell if remote access controls are failing?
A: Look for successful logins from accounts that should not normally use remote access, longer-than-expected sessions, and suspicious movement after authentication.
Practitioner guidance
- Review remote access as a privileged control Inventory every VPN and remote access path, then map which identities, groups, and services can reach critical systems through each one.
- Enforce MFA and patch discipline on edge appliances Prioritise MFA coverage, service reduction, and patch latency for all on-premise VPN appliances, especially where internet exposure is unavoidable.
- Reduce standing trust after authentication Segment internal access after login so a remote session does not inherit broad reach by default, and pair that with session monitoring and rapid revocation.
Bottom line: VPNs are becoming a measurable loss driver when they are treated as legacy connectivity instead of governed identity infrastructure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →