Insurance Claims Data Highlights MFA and Patching Risks in Manufacturing
Summary
Resilience's manufacturing insurance-claims analysis (March 2021–February 2026) attributes 90% of incurred losses to ransomware; MFA misconfigurations account for 26% and software exploits 13%. It recommends continuous MFA validation, patching, and fraud controls.
Key points
- The analysis draws on Resilience's manufacturing cyber insurance claims from March 2021 through February 2026, combined with public sources; its findings may not represent other industries.
- Ransomware accounted for 90% of incurred losses but 12% of claims in the portfolio.
- MFA misconfigurations were the largest identified failure point, linked to 26% of losses; the absence of MFA accounted for 8%.
- Software vulnerability exploits accounted for 13% of losses; the report recommends faster patching and compensating controls such as network isolation and enhanced monitoring.
- Transfer fraud and email compromise made up 30% of claims, with phishing and credential compromise identified as important failure points.
- Recommendations include continuously validating MFA, adding out-of-band confirmation and dual authorization for payment changes, and investing in ransomware containment and response.
Article Details
- Publisher
- SecurityWeek
- Report Period
- March 2021 through February 2026
- Scope
- Resilience's manufacturing cyber insurance claims analysis, synthesized with publicly available sources.
- Sample Size
- Not disclosed
- Key Statistics
- In Resilience's claims portfolio from March 2021 through February 2026, ransomware accounted for 90% of incurred losses and 12% of claims.
- MFA misconfigurations accounted for 26% of financial loss, compared with 8% attributed to the absence of MFA.
- Software vulnerability exploits accounted for 13% of losses in the portfolio.
- Transfer fraud and email compromise together accounted for 30% of claims.
- Infostealer malware delivered through phishing emails surged 84% year over year in 2024, according to the report.
- Recommendations
- Improve patching cycles; use network isolation, virtual patching, and enhanced monitoring as compensating controls for vulnerable systems.
- Continuously validate MFA deployments, ensuring enforcement across accounts, eliminating bypass conditions, and properly configuring conditional access policies.
- Use out-of-band confirmation for payment changes, dual authorization for large transactions, and targeted social-engineering training, especially for finance and accounting teams.
- Invest in ransomware containment and response.