At-Bay Report Finds Record Cyber Insurance Claim Severity

Summary

At-Bay’s 2026 InsurSec Report analyzes more than 100,000 policy years, finding claim frequency up 7% and average severity at a record $221,000. Ransomware averaged $508,000; remote access drove most ransomware claims, while fraud and liability claims also rose.

Key points

Overall claim frequency rose 7% year over year, while average claim severity reached a record $221,000.
Ransomware was the costliest incident type, with average severity of $508,000, up 16% from the prior year.
Remote access was the entry point in 87% of 2025 ransomware claims; VPN compromises accounted for 73% of claims with an identified entry vector, and one in three claims involved a SonicWall device.
Akira claim frequency rose 364% in the third and fourth quarters of 2025. The report says deployments often occurred within hours or minutes; all Akira victims that avoided encryption had 24/7 MDR monitoring.
Financial fraud accounted for about 30% of claims. Email was the entry vector in 82% of these incidents, and average stolen funds reached $285,000.
Third-party liability claims rose 70%; CIPA-related lawsuits accounted for 34% of those claims, up from 7% in 2023.
Businesses with less than $25 million in revenue saw ransomware frequency rise 21% and average severity climb 40% to $422,000.

Article Details

Publisher: At-Bay
Report Period: 2025 claims data; email monitoring analysis from September 2025 to March 2026
Scope: Cyber insurance claims, including ransomware, financial fraud, and third-party liability.
Sample Size: More than 100,000 policy years of claims data.
Key Statistics: Overall claim frequency rose 7% year over year; average claim severity reached $221,000.
Ransomware severity averaged $508,000, up 16% from the prior year.
Remote access was the entry point for 87% of ransomware claims in 2025; VPN compromises accounted for 73% of claims with an identified entry vector.
Akira ransomware frequency increased 364% in Q3 and Q4 2025; its average ransom demand was $1.2 million.
Third-party liability claims rose 70%; CIPA-related lawsuits made up 34% of those claims.
Recommendations: Retire vulnerable VPN appliances in favor of cloud- or SaaS-based remote access.
Use 24/7 managed detection and response where possible; otherwise deploy endpoint detection and response, configure it to block identified malicious activity, and monitor alerts.
Train employees to identify and report fraud, and deploy modern AI-backed email security to detect fraud indicators before messages reach employees.