Release Date: October 28, 2026
At-Bay’s 2026 InsurSec Rankings Report finds businesses with any VPN in its rankings carries 4.2X ransomware risk than having no VPN at all
KEY NEWS HIGHLIGHTS
- Report identifies the leading remote access products linked to elevated claims risk
- Email solution and secure email gateway rankings refreshed in third annual analysis
- New data from At-Bay’s post-cyber event hardening service revealed for first time
NEW YORK, October 28, 2026: At-Bay, the InsurSec provider for the digital age, today released its 2026 InsurSec Rankings Report. The report ranks the email and remote access tools used by At-Bay customers according to their real-world claims outcomes from 2025 through Q1 2026. It finds that businesses using SonicWall VPNs saw their relative ransomware risk climb from 5.8X to 8.4X year-over-year, while businesses with any VPN continued to see higher ransomware risk than those with no VPN at all.
“We’ve been warning businesses about VPN risk for several years now, and we continue to see that risk show up in our claims data,” said Adam Tyra, Chief Information Security Officer for Customers at At-Bay. “Year after year, businesses with a VPN have fared worse than businesses without one, and this year risk for SonicWall customers climbed from 5.8X to 8.4X. In many of these cases, attackers didn’t need an exploit. They logged in with valid credentials. Since credential theft is hard to stop outright, the priority should be making sure a stolen password alone can’t get an attacker into the network. That means enforcing phishing-resistant MFA on every remote access login, having someone actively monitoring for suspicious behavior around the clock, and, where possible, migrating from on-premise VPN appliances to cloud-based, zero-trust remote access.”
The findings in this report represent an analysis of more than 100,000 policy years of cyber claims data from 2021 through the first quarter of 2026.
Other key findings from the report:
- Every VPN in our rankings carried more ransomware risk than no VPN. Behind SonicWall (8.4X), businesses using Palo Alto GlobalProtect (4.3X), other VPNs (4.2X), Fortinet (3.8X), Citrix SSL VPN (3.7X), and Cisco ASA SSL VPN (3.3X) all saw higher ransomware claims frequency than businesses with no VPN. In At-Bay Security ransomware investigations where the initial access vector was known, VPN and RDP accounted for 65% of cases.
- Email claims remain high, but email security regained ground. Email claims frequency has stayed at roughly 3X 2021 levels since 2024. Average email claims frequency for policyholders with a secure email gateway fell 17% year-over-year. Proofpoint (down 26%) and Mimecast (down 17%) reclaimed the top two spots and were the only gateways with claims frequency below that average. Both, along with Barracuda (down 7%), added new AI-based detection since 2024.
- Google Workspace led email platforms for the fourth year, while Microsoft 365 kept improving. Google Workspace customers had the lowest email claims frequency of any email platform (0.155%), compared with 0.185% for Microsoft 365, though Google’s frequency remained above the levels At-Bay reported in 2024. Microsoft 365 customers saw improved outcomes year-over-year.
- Attackers borrow the brands and platforms employees trust. Of the millions of messages flagged by At-Bay MDR for Email this year, 10% used brand impersonation or abused infrastructure. Microsoft (24.7%) and DocuSign (21.9%) together made up 46.6% of brand impersonation volume. Among abused infrastructure, newly registered domains were most common (32.3%), followed by Meta (18.1%). Credential theft was the most common intent behind these messages.
- Businesses often lack basic controls, even after an attack. In its first six months, At-Bay’s Post-Cyber Event Hardening (PCEH) service, launched in April 2026 for policyholders, found that 60% had MFA missing or deployed on only some systems. 53% lacked email authentication controls such as SPF, DKIM, and DMARC. Many of these controls are already available in tools businesses use and carry no added cost to turn on.
- Many businesses overestimate their MFA coverage. A separate At-Bay analysis of claims over the past four years found that 30% of policyholders believed they had MFA in place when they didn’t.
To download the full report and learn how organizations can better protect themselves from cybercrime, visit: 2026 InsurSec Rankings Report.
Additional Resources:
About At-Bay
At-Bay is the InsurSec provider for the digital age. By combining world-class technology with industry-leading insurance, At-Bay was designed from the ground up to empower businesses of every size to meet cyber risk head-on. At-Bay Insurance Services, LLC provides insurance protection and security prevention solutions to close to 40,000 businesses in the US, safeguarding up to $800B in collective business revenue, and offers coverage by non-admitted insurers for Cyber, Technology Errors & Omissions (Tech E&O), and Miscellaneous Professional Liability (MPL). As a security company, At-Bay offers proprietary security solutions including At-Bay Stance Managed Detection & Response (MDR).
Michael Lowe, Head of Marketing