While headlines often focus on catastrophic ransomware attacks, the true financial risk to organizations often lies in high-frequency financial fraud and devastating vendor incidents, sometimes referred to as supply chain attacks. For those in the retail industry, this risk is amplified during the holiday shopping season, a time of year when retail websites and e-commerce platforms become prime targets for cyber threats. What if risk management teams could leverage real-time claims data to precisely identify and fortify their defenses against the most common and severe cyberattacks?
To gain this insider perspective, the LogicGate team sat down with Alex Friedl, CCIC, CIC, CISR Brokerage & Cyber Liability Client Executive, a highly certified expert with eight years of experience in cyber insurance. Alex shares professional expertise and practical insights derived from examining common types of claims, such as those resulting from phishing attempts and business email compromise.
This deep dive explores what cyber claim data tells us about maximizing prevention and response, stressing that robust cybersecurity practices are non-negotiable for safeguarding customer data and overall operations. We detail how essential security solutions, such as multi-factor authentication (MFA), minimize cyber risks and outline what to expect during the complex claims process, ensuring organizations can effectively mitigate threats and maintain customer trust.
The Most Frequent Cyber Claims: Business Email Compromise, Financial Fraud, and Third-Party Risk
In the world of cyber insurance, frequency and severity are two different metrics. According to Friedl, the most frequent claims typically involve Business Email Compromise (BEC), financial fraud, and incidents involving third-party providers.
Business Email Compromise and Financial Fraud
Business Email Compromise (BEC) occurs when a threat actor gains unauthorized access to an email inbox. This is frequently used to perpetuate financial fraud, such as credit card fraud or gift card scams, especially during the rush of holiday sales — although it can happen any time of year within any type of organization. A threat actor might compromise a CFO’s inbox and use it to send fraudulent invoices to clients or internal staff.
While many of these losses are under $100,000, Friedl notes that there is also a significant severity risk; he has personally seen a $3 million loss from a single client due to financial fraud. These incidents often occur because of a lack of basic controls on email inboxes.
“One of the first questions that the incident response firms ask is, was there multi-factor authentication on this email inbox? And, inevitably, the answer is no.” — Alex Friedl
Third-Party and Vendor Incidents
Third-party risk is a major driver of claim frequency, particularly for online retail. Because businesses increasingly rely on vendors to store customer data, a single incident at a software provider can affect hundreds or thousands of organizations simultaneously. This creates a web of risk where one vendor’s breach leads to dozens of downstream insurance claims.
“This is something that’s going to continue to happen as more and more businesses rely on third parties to store their data and to do business. And that is a very, very common type of claim that we see.” — Alex Friedl
The Most Severe Claims: The True Cost of Ransomware Attacks
Incident Frequency Does Not Equate to Incident Severity
While BEC is more common, ransomware attacks involving sophisticated malware remain the most severe type of claim in terms of total cost. These incidents have the potential to cause significant downtime and disruptions. Interestingly enough, the primary driver of claim severity as of recently is not necessarily the operational downtime or ransom payment itself.
“We’ve had several seven-figure ransom losses, and it’s not tied to the payments themselves or the costs of cleaning up the incident, but now we’re actually seeing class action litigation in relation to these incidents, and that is what we see driving recent losses.” — Alex Friedl
In addition to the class action litigation, organizations must consider the reputational damage that follows the attack. As an example, organizations in the retail sector may face massive costs even if they do not pay the ransom.
Prevention Controls: Lessons Learned from Incident Vectors
Essential Controls for Business Email Compromise and Phishing
As we’ve learned, BEC is cited as one of the most frequent types of cyber insurance claims today. While often a precursor to broader financial fraud, the following controls are critical for preventing and mitigating these incidents.
1. Mandatory Multi-Factor Authentication (MFA)
The single most effective way to lower the risk of an email account takeover is implementing MFA across all email access points.
- The Gap: In many triaged incidents, the primary reason for the breach was the absence of MFA on the compromised inbox.
- The Defense: Even if a bad actor obtains a username and password, MFA provides a crucial second layer of defense that is difficult to bypass.
2. Advanced Phishing Defense and Training
Phishing remains a top vector for both BEC and more severe ransomware attacks. A robust defense requires a multi-layered approach to human and technical vulnerabilities:
- Email Filtering: Implementing technical controls to catch malicious emails before they reach the user.
- Simulations and Training: Conducting regular phishing simulations and employee training to ensure staff can recognize and report suspicious requests.
Mitigating Financial Fraud and Improving Claim Success
Financial fraud is another frequent type of cyber claim, often occurring when a threat actor compromises a high-level inbox (like a CFO’s) to send fraudulent invoices internally or to clients. In addition to the BEC controls discussed above, additional steps can be taken to mitigate the risk of financial fraud occurring within your organization.
1) Out-of-Band (OOB) Communication Protocols
To prevent these high-value losses, organizations must move beyond email-only verification. Establishing an “out-of-band” method creates a secondary layer of authenticity for fund transfers.
- Threshold-Based Verification: Any request involving a change in banking information or a payment exceeding a specific dollar amount should trigger a secondary check.
- Independent Verification Channels: Verification must be done through a trusted, pre-existing method, such as calling a known phone number.
- The “Trusted Source” Rule: Never use the contact information provided in the suspicious email or invoice, as threat actors have been known to answer those numbers themselves to “verify” the fraud.
2) Strategic Insurance Provisions for Claims Approval
Even with strong technical controls, the specific language in your insurance policy can determine if a claim is actually paid.
- Eliminate “Callback” Provisions: Many policies include a “callback” provision that requires out-of-band confirmation to be performed for coverage to apply. Experts recommend working with a broker to remove this language, as claims have been denied because an employee simply forgot to perform the manual check.
- Immediate Reporting Requirement: For all cyber incidents—not just financial fraud—it is critical to report the loss to the insurance carrier immediately to ensure the claim moves forward as expected.
Mitigating Vendor Risk and Supply Chain Attacks
Since organizations have limited control over a vendor’s internal tools, Friedl notes that the best way to mitigate this type of risk is through a combination of robust vendor due diligence and contract management.
- Tiered Due Diligence: Organizations should categorize vendors by the sensitivity of the data they hold (e.g., PII or PHI) and apply more rigorous requirements to higher-tier partners.
- The “Right to Audit”: For critical vendors, sophisticated organizations should request the right to review specific audit reports, such as a SOC 2 Type 2, to verify their internal controls.
- Contractual Safety Nets: Contracts should mandate that vendors carry adequate cyber insurance limits and provide notification of any incident within a strict timeframe, such as 24 hours.
Hardening Against Ransomware Attack Vectors
While ransomware is less frequent than email compromise, it represents the most severe threat to organizations due to the high costs of system remediation, ransom payments, and the recent rise in costly class-action litigation. To address this, risk management teams should distinguish between technical safeguards that prevent an attack and insurance provisions that protect the balance sheet if one occurs.
1) Technical Controls: Prevention and Mitigation
- Secure Remote Access: It is critical to secure all remote access points to the network using multi-factor authentication (MFA).
- Vulnerability Management: Organizations must maintain a rigorous patching cadence to address critical software vulnerabilities that threat actors exploit.
- Phishing Defenses: Since phishing is a top vector, teams should implement robust email filtering and conduct regular phishing simulations and employee training.
- Network-Segmented Backups: To mitigate the impact of a successful breach, backups must be physically or logically separated from the rest of the network. This ensures that if the primary network is encrypted, the backups remain untouched, preventing a “bad day from getting a lot worse”.
2) Insurance Provisions: Protecting the Organization
Friedl notes that because ransomware carries such high severity risk, generic cyber policies may not provide sufficient financial protection without specific review of the following terms. He recommends that organization pay close attention to the following:
- Full Ransomware and Extortion Limits: Insurance companies often attempt to reduce their exposure by “sub-limiting” ransomware or cyber extortion coverage. Risk managers should ensure the policy provides “full coverage” that matches the total policy limit (e.g., a $5 million limit for ransomware on a $5 million policy).
- Access to Breach Response Experts: A key provision of cyber insurance is the immediate access it provides to a “fire department” of experts. This includes digital forensics firms to remediate systems and privacy attorneys to manage regulatory notifications and potential litigation. While there is often overlap, different insurance carriers have different vendors available to policyholders. Insurance buyers should review the vendor panel and make sure that they are comfortable with the available vendors.
The Response: Navigating the Cyber Insurance Claims Process in Real-Time
No organization wants to find themselves in the position of filing a cyber insurance claim. The process is often born from a moment of crisis and high stress. However, understanding the mechanics of the claims journey before an incident occurs is critical for ensuring the process goes smoothly, claims are approved, and operations are restored in a timely manner. As Alex Friedl highlights, being prepared means recognizing that a cyber policy is more than just a financial safety net.
“What’s unique about a cyber policy is that when you make the purchase, you’re not just buying insurance coverage, you’re buying access to the fire department as well. You’re buying access to the breach response experts that are going to triage the incident.” — Alex Friedl
Immediate Action and Initial Triage
The foundation of a successful claim is speed. To ensure things move along as hoped, organizations must prioritize immediate reporting to their carrier for all types of losses. Once a claim is filed, the experience typically begins with a scoping call — an initial triage session where the “fire department” meets with the organization to assess the damage. This call involves two essential players:
- Privacy Attorney: While it may seem counterintuitive to involve legal counsel during a technical crisis, their role is vital for determining if Personally Identifiable Information (PII) or Protected Health Information (PHI) was accessed. They guide the organization through the complex web of notifying regulatory authorities and impacted individuals.
- Digital Forensics Firm: Friedl notes that these technical experts are responsible for the hands-on remediation of computer systems, investigating the extent of the breach, and getting the business back up and running.
By understanding this ecosystem of attorneys, forensic experts, and secondary vendors who assist with notification letters and litigation, risk managers can better navigate the pressure of an active incident.
Next Steps: How to Shift from Reactive to Proactive Cyber Risk Management
The real-time metrics and insights derived from today’s most common and severe cyber claims tell a powerful story that risk management teams can use to their advantage. To effectively operationalize these lessons—from mandating MFA to managing complex supply chain attacks—organizations need a unified risk management platform.
LogicGate Risk Cloud is the Leading AI-Powered Enterprise GRC Platform, providing cyber risk teams with a single, interconnected view across their complete risk and compliance environment. Real-time, aggregated insights alongside workflow automations empower cyber risk teams to accelerate positive business outcomes and protect against vulnerabilities. Connect with the LogicGate team for a custom demo of Risk Cloud today.
