Topic starter
24/10/2026 8:49 pm
TL;DR: Remote access tools account for 80% of ransomware claims, according to At-Bay, because on-premise VPNs are being used as governed identity infrastructure instead of legacy connectivity. VPN controls need tighter monitoring and less standing trust after authentication to limit insurer-visible severity.
Editorial analysis by NHI Mgmt Group, based on content published by At-Bay: “The Cyber Insurance Market Needs Rate, but Rate Alone Won’t Solve the SMB Cyber Problem”.
Key questions
Q: Why do on-premise VPNs drive higher ransomware losses than cloud-based remote access?
A: On-premise VPNs often combine exposed infrastructure, broad network reach, and delayed maintenance, which gives attackers a shorter path from entry to impact.
Q: How can security teams tell if remote access controls are failing?
A: Look for successful logins from accounts that should not normally use remote access, longer-than-expected sessions, and suspicious movement after authentication.
Q: What fails when an SMB relies on an on-premise VPN without strong governance?
A: The failure is not the VPN alone.
Practitioner guidance
- Review remote access as a privileged control Inventory every VPN and remote access path, then map which identities, groups, and services can reach critical systems through each one.
- Enforce MFA and patch discipline on edge appliances Prioritise MFA coverage, service reduction, and patch latency for all on-premise VPN appliances, especially where internet exposure is unavoidable.
- Reduce standing trust after authentication Segment internal access after login so a remote session does not inherit broad reach by default, and pair that with session monitoring and rapid revocation.
Bottom line: VPNs are becoming a measurable loss driver when they are treated as legacy connectivity instead of governed identity infrastructure.
Glossary terms: Remote Access Identity, Standing Privilege, Post-Authentication Threat
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/10/2026 11:13 am
Remote access has become an identity control problem, not just a perimeter problem. When a VPN authenticates users into internal trust, the control that matters is no longer the tunnel itself but the governance around who can use it, under what conditions, and with what monitoring. That is why SMBs with rapid growth and limited security staff are seeing outsized loss exposure. Practitioners should treat remote access as part of the identity plane, not as a separate network utility.
A question worth separating out:
Q: Who should be accountable for VPN risk in a growth-stage SMB?
A: Accountability should sit jointly with identity, infrastructure, and security leadership because VPN risk crosses authentication, configuration, and response. The teams that own remote access also need to own the evidence that it is patched, observed, and scoped correctly. If no one owns the control chain end to end, insurers will treat the exposure as unmanaged.
👉 Read our full editorial: VPN risk concentration is reshaping SMB cyber insurance pricing
This post was modified 7 days ago by NHI Mgmt Group