Cyber Insurance Claims Highlight Email Fraud and Exposed Network Devices as Key Risks
Summary
Daniel Woods’ analysis of Coalition claims points to email-based fraud as a leading incident source and exposed VPNs and firewalls as significant ransomware risks. He cautions that unclaimed incidents may be missing from the data.
Key points
- Woods estimates that about 1,500 of Coalition’s 100,000 customers experience an incident annually, but says unclaimed incidents may be underrepresented.
- He estimates fund transfer fraud accounts for about 60% of incidents, business email compromise 20%, and ransomware 20%.
- Almost 80% of incidents in the claims data were associated with email-based threats; Woods describes ransomware incidents as especially severe and prolonged.
- Organizations with exposed Cisco ASA devices were five times more likely to file a claim; Woods says similar risks apply to Fortinet, Citrix, and SonicWall products.
- Forensic reports reviewed by Woods linked about half of incidents to exploited VPNs or firewalls and another 20% to remote access devices.
- Woods attributes an estimated 40–60% of incidents to stolen credentials and missing enforced MFA; he says many other incidents involved recently disclosed, unpatched vulnerabilities.
- Woods reports lower risk correlated with cloud-hosted email and says advanced security awareness training may help reduce claims, while basic phishing-focused training had mixed results.
Article Details
- Publisher
- Team Cymru
- Scope
- Cyber insurance claims data from Coalition and associated forensic reports, used to examine incident patterns and security controls.
- Sample Size
- 100,000 Coalition customers
- Key Statistics
- Woods reported that about 1,500 of 100,000 Coalition customers suffer an incident each year, an annualized frequency of about 1.5%; he cautioned that claims data may underreport incidents.
- Woods estimated that fund transfer fraud accounts for about 60% of incidents, business email compromise for about 20%, and ransomware for about 20%.
- Almost 80% of incidents were related to email-based threats, based on claims for fund transfer fraud and business email compromise.
- Based on forensic reports, Woods found that about 50% of incidents involved exploited VPNs or firewalls and another 20% involved remote access devices; organizations with exposed Cisco ASA devices were five times more likely to file a claim.
- Woods said multi-factor authentication secures accounts over 90% of the time at an individual level, while noting organizational deployment gaps.
- Recommendations
- Enforce multi-factor authentication and address accounts or deployment gaps where it is not enabled.
- Patch vulnerabilities promptly, since Woods said many incidents involved vulnerabilities exploited within weeks or a month of publication.
- Review externally exposed VPNs, firewalls, and other perimeter or remote access devices.
- Use security awareness training that covers advanced social engineering, including risks from installing remote management software.
People
Vendors
CiscoFor example, Woods found organizations with exposed Cisco ASA devices were five times more likely to file a claim. But this was not just a Cisco issue, but also applies to equivalent Fortinet, Citrix, and SonicWallCitrixlikely to file a claim. But this was not just a Cisco issue, but also applies to equivalent Fortinet, Citrix, and SonicWall products. And based on reading forensic reports for complimentary causal evidence, WoodsCoalitionThreat Intelligence podcast, Eli Woodward is joined by Daniel Woods, Principal Security Researcher at Coalition and cybersecurity lecturer at the University of Edinburgh. During the podcast, the two discuss theFortinettimes more likely to file a claim. But this was not just a Cisco issue, but also applies to equivalent Fortinet, Citrix, and SonicWall products. And based on reading forensic reports for complimentary causalGoogleproviders automation patching and centralized monitoring for phishing and fraud. In particular, Google Workspace was found to be better than Microsoft Office 365, potentially due to different business models.Microsoftmonitoring for phishing and fraud. In particular, Google Workspace was found to be better than Microsoft Office 365, potentially due to different business models. Workspace offers email filtering features forSonicWallfile a claim. But this was not just a Cisco issue, but also applies to equivalent Fortinet, Citrix, and SonicWall products. And based on reading forensic reports for complimentary causal evidence, Woods found that
Products
Cisco ASAFor example, Woods found organizations with exposed Cisco ASA devices were five times more likely to file a claim. But this was not just a Cisco issue, but also applies to equivalent Fortinet, Citrix, and SonicWallGoogle Workspaceproviders automation patching and centralized monitoring for phishing and fraud. In particular, Google Workspace was found to be better than Microsoft Office 365, potentially due to different business models.Office 365for phishing and fraud. In particular, Google Workspace was found to be better than Microsoft Office 365, potentially due to different business models. Workspace offers email filtering features for free,