AI-generated, AI-updated weekly, AI quality-checked, and source-cited, this 90-day Rolling Intelligence Card reconciles current carrier claims reports, broker market updates, reinsurer research, supervisory analysis, and incident-response observations into a decision-ready view of loss frequency and severity, ransomware and funds-transfer outcomes, recovery expense, failed controls, pricing and capacity, policy structure, underwriting changes, coverage ambiguity, and systemic accumulation risk.
| Field | Value | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Decision Question / User Topic | Cyber insurance claims, coverage, underwriting, pricing, capacity, and accumulation signals that materially change how organizations should buy coverage, prepare for a claim, or explain cyber loss exposure during the active rolling 90-day window. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Interpreted Questions | What are insurers and brokers actually observing about claim frequency and severity? Which events create the largest retained losses? Are ransomware demands being paid, negotiated, or refused? How do BEC and funds-transfer fraud become insured losses? Which controls and technologies repeatedly appear in claims? Are rates, limits, retentions, sublimits, coinsurance, dependent-business-interruption terms, or exclusions changing? Which findings are carrier-specific, which are market observations, and which could signal systemic portfolio accumulation? | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Initial Observations | The retained evidence does not support one universal market statistic. Cowbell, At-Bay, Chubb, and Gallagher analyze different portfolios, geographies, revenue bands, and periods; their percentages therefore remain separate. Across those distinct datasets, however, three points recur: business interruption and data exfiltration multiply ransomware severity; email, identity, remote access, and third parties continue to drive claims; and a competitive market is broadening some terms while underwriters demand stronger evidence of MFA, monitoring, patching, supplier oversight, backups, and response readiness. BIS and Munich Re add the portfolio-level warning: shared technology dependencies and ambiguous coverage can turn many individually acceptable risks into one correlated event.[2][3][4][5][6][7][10][11]First cited source Jun 17, 2026 · Latest cited source Jul 24, 2026 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Source Coverage |
Complete Tier 0–8 counts are shown here. The 8 retained sources and their claim treatment are identified in Citations. Planned integrations are not counted as checked or selected. |
Reporting-Period Statistics
At-a-glance measures from the retained evidence set. Citations identify the source controlling each statistic.
Period Coverage
90 calendar days, inclusive. Records are included by their first-observed date inside this window; the period does not imply that every underlying incident began or was confirmed during it.
$82.6K[3]
SME claim severity
Chubb EMEA 2025 average for $0–99M revenue cohort.Evidence dated Jul 2026
100
Share of referenced incidents
Gallagher referenced incident mix
2025 UK claims mix published in the 7 May 2026 report. This is a broker-observed historical cohort, not the rolling window's incident count.Evidence dated Source date not published
Intended Reader and Decision Context
Who this brief is written for, the geographic and organizational lens it uses, and how readers should apply the intelligence.
| Audience Field | Assessment |
|---|---|
| Audience fieldPrimary audience | AssessmentBoards, CFOs, risk managers, CISOs, CIOs, general counsel, insurance buyers, brokers, underwriters, claims leaders, incident-response owners, and business-continuity executives. |
| Audience fieldOrganization profile | AssessmentU.S.-oriented and useful to SMB, midmarket, enterprise, healthcare, manufacturing, retail, professional-services, technology, and organizations with material SaaS, remote-access, payment, or supply-chain dependencies. |
| Audience fieldDecision perspective | AssessmentUse the card to set renewal priorities, identify evidence required by underwriters, test whether likely loss scenarios fit limits and sublimits, preauthorize incident vendors, and decide which technology or control gaps could cause both a breach and a difficult claim. |
| Audience fieldEvidence posture | AssessmentPortfolio statistics are directional and cohort-specific. They do not predict an individual insured's claim, guarantee coverage, or replace review of the actual policy and facts by broker, insurer, and counsel. |
Chronology and Decision Milestones
Carrier reports, broker market updates, reinsurer and supervisory analysis, and practitioner signals are dated by publication. Underlying claims periods remain explicit and are never presented as losses that occurred entirely inside this rolling window.
Supervisory analysis
The Financial Stability Institute synthesizes market interviews and research to show why cyber insurance remains difficult to price and diversify when many insureds share cloud, software, managed-service, and infrastructure dependencies.[2]
Incident-response forum signal
Practitioners report attackers bypassing controls through people, account recovery, identity, and SaaS paths. The signal is qualitative but directly relevant to underwriting questions and claim investigation.[4]
Carrier severity update
Chubb's current report says EMEA SME frequency and severity rose, while frequency fell for middle-market and large companies even as severity increased. It also identifies business interruption as a major ransomware severity driver and U.S. litigation as a loss multiplier.[3]
Bottom Line Up Front
Business interruption—not the ransom alone—often determines whether a ransomware claim becomes severe: At-Bay says ransomware claims with operational downtime had three times the severity in its cohort, and Chubb identifies business interruption as a principal ransomware severity driver. Recovery architecture, restoration time, and dependent operations therefore belong in limit selection and exercises.[3]Evidence dated Jul 2026
Email fraud and direct funds-transfer pathways remain major insured loss channels: Carrier reporting continues to place BEC and financial fraud near the center of claim volume. Identity verification, payment-change controls, rapid bank notification, and preplanned recovery actions can change the net loss more than another generic awareness module.[4]Evidence dated Jun 17, 2026
Shared technology can create one event across many insureds: BIS and Munich Re warn that cloud, software, managed-service, supply-chain, and AI dependencies create correlated loss and accumulation risk. Buyers should identify the providers whose failure could exhaust dependent-business-interruption limits; carriers need portfolio visibility beyond industry labels.[2]Evidence dated Jun 17, 2026
Decision Context
This card answers two different executive questions: what is causing insured cyber losses, and how is the insurance market responding? The retained sources show a functioning, competitive market, but not a simple one. Strong capacity and broader terms coexist with rising severity in important cohorts, stricter evidence demands, coverage ambiguity around new technology, and concern that one shared provider can affect many insureds at once.[2][3]First cited source Jun 17, 2026 · Latest cited source Jul 2026
Ransomware remains the most visible severity event, yet the ransom payment is only one component. At-Bay links operational downtime to three-times-higher severity in its claims cohort; Chubb similarly identifies business interruption as a primary severity driver. Gallagher reports that ransomware led its referenced incident mix and that data exfiltration accompanied many cases. Executives should therefore size coverage and exercises around restoration time, lost revenue, data response, notification, litigation, and supplier/customer interruption—not just an assumed ransom amount.[3]Evidence dated Jul 2026
BEC and funds-transfer fraud continue to create losses through both compromised email and direct access to financial workflows. The control objective is transaction integrity: independent verification of bank-detail changes, limits and dual authorization, identity-resistant help-desk processes, rapid financial-institution escalation, and preserved evidence. The organization must know which policy insuring agreements, sublimits, conditions, and notice requirements apply before a payment leaves.[4]Evidence dated Jun 17, 2026
The market is rewarding demonstrable control maturity, but questionnaires are not proof. Gallagher emphasizes MFA, network security, staff training, patch cadence, and supplier oversight; NetDiligence adds identity recovery and SaaS access. Underwriters and buyers should test whether controls cover privileged accounts, remote access, cloud identities, service desks, and third parties—not merely whether a box is checked.[4]Evidence dated Jun 17, 2026
Policy structure matters as much as the headline limit. Waiting periods, restoration periods, bricking language, dependent-business-interruption triggers, named-provider schedules, per-claim versus aggregate limits, social-engineering or funds-transfer sublimits, coinsurance, retentions, and consent requirements can materially change recovery. Competitive conditions create an opportunity to negotiate clarity before a loss.[2]Evidence dated Jun 17, 2026
Systemic accumulation is the portfolio-level concern. BIS and Munich Re describe protection gaps and correlated dependencies; Cowbell supplies concrete event examples. A cloud, identity, remote-management, widely deployed software, or managed-service failure can trigger many organizations and several lines of insurance simultaneously. Buyers should map dependency concentration; carriers should model it across the portfolio.[2]Evidence dated Jun 17, 2026
The executive standard is evidence-ready resilience. Maintain a current asset and dependency inventory, prove the operation of key controls, match realistic loss scenarios to actual policy language, preapprove counsel and response vendors, test notice and consent workflows, and preserve the records needed to demonstrate both the incident and the claimed loss.[2][3][4]First cited source Jun 17, 2026 · Latest cited source Jul 2026
Executive Briefing Priorities
Do not combine carrier statistics — Cowbell, At-Bay, Chubb, and Gallagher observe different insured populations, periods, regions, revenue bands, and claim definitions. Their findings can corroborate a pattern but cannot be arithmetically merged into one market rate.[3]Evidence dated Jul 2026
Downtime is a severity multiplier — At-Bay reports three-times-higher severity when ransomware caused operational downtime; Chubb also places business interruption at the center of ransomware severity.[3]Evidence dated Jul 2026
BEC is both a claim and a gateway — Carrier and practitioner reporting shows email compromise, social engineering, identity recovery, SaaS access, and financial workflows converging into theft and follow-on intrusion.[4]Evidence dated Jun 17, 2026
Ransom payment is not the loss model — Negotiation and nonpayment can reduce extortion cost, but restoration, interruption, forensics, notification, legal response, liability, and reputation can dominate total severity.[3]Evidence dated Jul 2026
Competitive pricing does not eliminate restrictive structure — A lower rate can coexist with retentions, waiting periods, coinsurance, sublimits, named-provider restrictions, consent provisions, or narrower dependent-business-interruption language.[2]Evidence dated Jun 17, 2026
Control evidence influences both underwriting and claims — MFA, monitoring, patching, backups, training, supplier oversight, and identity controls should be continuously evidenced, not reconstructed at renewal or after an incident.[4]Evidence dated Jun 17, 2026
Shared providers create accumulation risk — Cloud, managed services, identity platforms, widely used software, and infrastructure dependencies can correlate losses across many insureds and policy lines.[2]Evidence dated Jun 17, 2026
Coverage clarity is an executive control — The board should know which loss scenarios are covered, sublimited, excluded, subject to consent, or dependent on a named provider before approving risk transfer as a resilience strategy.[2]Evidence dated Jun 17, 2026
Source-Bound Exposure and Targeting
This is not a raw victim list. Publicly named organizations are shown when reliable sources identify them, with confirmation and attribution boundaries preserved. Where no defensible name exists, IntelliOS uses the narrowest supported exposure population. Sector or geography matches remain scoping signals; they do not prove compromise.
| Victim / exposure population | Sectors | Geography | Confirmation status | How companies should use it |
|---|---|---|---|---|
| Victim / exposure populationSMB and lower-middle-market insureds[3]Evidence dated Jul 2026 | SectorsCross-industry; especially organizations with limited security and recovery staffing | GeographyEMEA evidence with global relevance | Confirmation statusChubb reports both frequency and severity pressure in its SME cohort; carrier-specific, not a universal rate. | How companies should use itStress-test retention affordability, incident vendor access, restoration time, notification expense, and whether a single event could exhaust the limit. |
| Victim / exposure populationOrganizations dependent on vendors, customers, cloud, or managed services[2]Evidence dated Jun 17, 2026 | SectorsCross-industry | GeographyGlobal | Confirmation statusMultiple sources identify third-party and shared-service loss pathways. | How companies should use itMap dependency concentration, contract notice, fallback operations, and the exact policy trigger and sublimit for dependent interruption. |
Distinct Operational Records
The recurring high-severity scenario combines operational downtime, data theft, restoration, notification, liability, and negotiation expense. Payment is only one branch of the loss tree.[3]Evidence dated Jul 2026
Compromised mailboxes, impersonation, account recovery, SaaS access, and payment-workflow manipulation can produce direct theft, recovery expense, and coverage disputes over the applicable insuring agreement or sublimit.[4]Evidence dated Jun 17, 2026
Supplier, customer, cloud, software, and service-provider failures can create losses without a security failure inside the insured's own environment.[2]Evidence dated Jun 17, 2026
Data exfiltration, website tracking, notification, litigation, and jurisdictional privacy rules can extend a technical incident into multi-year liability and defense cost.[2][3]First cited source Jun 17, 2026 · Latest cited source Jul 2026
Source-Bound Actor Context
These insurers supply portfolio-specific claims evidence. Their findings are valuable precisely because they are not treated as one interchangeable dataset.[3]Evidence dated Jul 2026
BIS frames market sustainability and accumulation; NetDiligence supplies active practitioner observations about identity and SaaS-enabled incidents.[2][4]Evidence dated Jun 17, 2026
Enterprise Exposure
At-Bay reports that one in three ransomware claims in its 2025 cohort involved SonicWall; that historical carrier cohort is separate from the current CVE-2026-15409/CVE-2026-15410 SMA1000 campaign. SonicWall now confirms active exploitation. A policyholder should identify every SMA1000 6210, 7210, and 8200v, validate its fixed release, investigate historical exposure, rotate appliance-accessible credentials, and test whether compromise reached identity or internal systems.[5][6]First cited source Jul 14, 2026 · Latest cited source Jul 24, 2026
CISA and NVD identify active exploitation of an unauthenticated code-execution flaw that can run in the server's root context. Langflow is narrower than a mainstream VPN product, but an exposed instance may hold API keys, model credentials, data connectors, flows, and privileged service access. For an insured, the loss path can include secret theft, connected-service compromise, data exposure, trusted-workflow alteration, response cost, and dependent interruption.[5][7]First cited source Jul 21, 2026 · Latest cited source Jul 24, 2026
CISA marks known ransomware use, while Oracle identifies remotely exploitable affected versions. PeopleSoft commonly concentrates employee, payroll, student, and financial data; compromise can therefore combine extortion, privacy response, business interruption, credential exposure, and notification costs.[5]Evidence dated Jul 24, 2026
Check Point confirms active exploitation of an authentication bypass in deprecated IKEv1 remote-access configurations and assesses a financially motivated/Qilin association with medium confidence. Insureds should confirm whether the deprecated configuration exists, apply the hotfix, review VPN activity, and preserve evidence before treating remediation as complete.[5]Evidence dated Jul 24, 2026
CISA marks known ransomware campaign use and PTC directs customers to patch and hunt for web shells. Manufacturers, engineering organizations, and suppliers may face theft of product designs and intellectual property, disruption of engineering workflows, credential compromise, and downstream contractual loss.[5][10]First cited source Jun 18, 2026 · Latest cited source Jul 24, 2026
The Canadian Cyber Centre groups a current cluster of actively exploited on-premises SharePoint vulnerabilities. Because SharePoint can hold collaboration data, credentials, workflows, and business records, compromise can produce a broad privacy, interruption, legal, and restoration claim. Cloud SharePoint should not be conflated with affected on-premises products.[5][11]First cited source Jul 16, 2026 · Latest cited source Jul 24, 2026
Claims and practitioner reporting still show attackers exploiting people, account recovery, cloud identities, backups, hypervisors, and recovery tooling. These controls determine whether a named-product intrusion stays local, becomes a funds-transfer event, or expands into prolonged interruption and ransom pressure.[3][4]First cited source Jun 17, 2026 · Latest cited source Jul 2026
Current Carry-Forward Watchlist
Prioritized claim drivers, policy mechanics, underwriting controls, technology dependencies, and market signals that require a named monitoring owner.
| # | Threat / Category | Why It Matters | What to Monitor | IntelliOS Coverage |
|---|---|---|---|---|
| 1 | Threat / Category Claims severity Operational downtime and restoration duration[3]Evidence dated Jul 2026 | Why it mattersDowntime repeatedly separates manageable ransomware events from severe claims. | What to monitorRecovery-time tests, backup integrity, clean-room capacity, critical-process dependencies, lost revenue evidence, and restoration cost. | IntelliOS coverage |
| 2 | Threat / Category Fraud BEC and funds-transfer loss pathways[4]Evidence dated Jun 17, 2026 | Why it mattersFinancial fraud can begin with email, identity, SaaS, or direct financial-system access. | What to monitorPayment-change verification, dual approval, new beneficiaries, mailbox rules, impossible travel, help-desk resets, and bank escalation time. | IntelliOS coverage |
| 3 | Threat / Category Third party Dependent-business-interruption triggers[2]Evidence dated Jun 17, 2026 | Why it mattersSupplier or customer incidents may be insured differently from internal failures. | What to monitorNamed providers, direct/contingent wording, waiting period, sublimit, restoration period, supplier notice, and fallback capability. | IntelliOS coverage |
| 4 | Threat / Category Policy structure Limits, retentions, sublimits, coinsurance, and aggregation[2]Evidence dated Jun 17, 2026 | Why it mattersHeadline limits can overstate available recovery for the most likely scenario. | What to monitorSocial-engineering and FTF sublimits, ransomware coinsurance, privacy-defense limits, aggregate erosion, bricking, betterment, and consent. | IntelliOS coverage |
| 5 | Threat / Category Underwriting Evidence behind control attestations[4]Evidence dated Jun 17, 2026 | Why it mattersUnderwriters increasingly reward proof, not policy statements. | What to monitorMFA coverage, EDR/MDR monitoring, patch SLAs, backup tests, training outcomes, privileged access, supplier reviews, and exceptions. | IntelliOS coverage |
| 6 | Threat / Category Accumulation Shared cloud, software, identity, and MSP concentration[2]Evidence dated Jun 17, 2026 | Why it mattersOne dependency can affect many business units and many insureds. | What to monitorProvider inventory, concentration by revenue process, common software versions, geographic clustering, correlated policy lines, and modeled maximum loss. | IntelliOS coverage |
| 7 | Threat / Category Claims readiness Notice, consent, panel, and evidence obligations[2]Evidence dated Jun 17, 2026 | Why it mattersDelay or unauthorized vendor engagement can complicate recovery. | What to monitor24/7 notice route, approved counsel/forensics, ransom or restoration consent, loss documentation, privilege plan, and insurer communications. | IntelliOS coverage |
| 8 | Threat / Category Coverage ambiguity AI, non-affirmative cyber, and new loss mechanisms[2]Evidence dated Jun 17, 2026 | Why it mattersEmerging technology can create disputes about which policy or exclusion applies. | What to monitorAI use cases, autonomous actions, system-failure versus cyber triggers, silent cyber, contractual liability, and cross-line aggregation. | IntelliOS coverage |
Operational Standards from the Evidence
The practices below convert carrier, broker, reinsurer, claims, incident-response, and supervisory evidence into repeatable insurance-buying and claims-readiness standards.
Best Practice
Lesson Learned
The same intrusion can create interruption, restoration, privacy, liability, fraud, and extortion costs under different policy sections.
Minimum Operating Standard
Run at least ransomware, funds-transfer, cloud outage, and vendor-breach loss scenarios against actual limits, sublimits, retentions, waiting periods, and exclusions.
Best Practice
Lesson Learned
A renewal answer is less useful than proof that the control operated when loss occurred.
Minimum Operating Standard
Retain MFA, monitoring, patch, backup, training, vendor, and access-control evidence with named owners and exception records.
Best Practice
Lesson Learned
A shared dependency can create correlated loss across entities, products, and policies.
Minimum Operating Standard
Identify cloud, identity, MSP, software, telecom, payment, and data-provider concentration and compare it with policy aggregation language.
Automation Transparency
| Agent | Cyber Insurance Claims, Coverage & Underwriting Rolling Intelligence Card Publisher |
|---|---|
| Status | Active · rolling 90-day automation |
| Cadence | Weekly on Tuesday at 12:30 PM ET |
| Previous run | 24 Jul 2026 · 12:30 PM ET · Run cyber-insurance-activity-2026-07-24-1230 |
| Previous result | Named-technology correction completed; current exploitation records were reconciled with carrier loss evidence without treating vendor advisories as claims. |
| What the previous run found |
|
| Next run | 28 Jul 2026 · 12:30 PM ET |
| Sources monitored |
|
| Publication and alert policy | Publish and alert only when a source-backed change materially affects claims frequency or severity, loss causation, payment outcome, recovery expense, underwriting controls, pricing/capacity, policy structure, coverage dispute, or accumulation risk. Suppress no-change messages. |
Related Intelligence and CARDS Records
Rolling Intelligence
Connected ransomware operators, access paths, victimology, recovery, and operational severity signals.
Open productRolling Intelligence
Connected BEC, AiTM, payment fraud, victimology, and financial-control intelligence.
Open productRolling Intelligence
A cross-catalog, source-backed 90-day watchlist of named products under active exploitation and the loss paths they create for owners and insurers.
Open productPublication History
| Version | Date | Change | Monitoring |
|---|---|---|---|
| Versionv4 | Date24 Jul 2026 | ChangeCorrected the policyholder-technology section. Added source-backed rows for SonicWall SMA1000, Langflow, Oracle PeopleSoft, Check Point Security Gateway, PTC Windchill/FlexPLM, and on-premises SharePoint; explicitly separated active-exploitation evidence from historical insurance-claims cohorts; and connected the new Exploitable Technology Risk Rolling Intelligence Card. | MonitoringWeekly Tuesday material-change review |
| Versionv3 | Date24 Jul 2026 | ChangeAdded the PETRA report database to the Tier 6 source audit and weekly monitor. The query confirmed that PETRA’s insurance and claims corpus is largely published in arrears: no report had a publication date inside Apr 26–Jul 24, so older annual and period reports remain discovery-only. | MonitoringWeekly Tuesday material-change review |
| Versionv2 | Date24 Jul 2026 | ChangeRebuilt Research Framing source coverage as a complete Tier 0–Tier 8 audit. The ledger now identifies 22 checked sources, eight selected publications, 14 checked-but-not-used regulator, carrier, broker, reinsurer, claims, and tracker sources, and the exact role of every tier. | MonitoringWeekly Tuesday material-change review |
| Versionv1 | Date24 Jul 2026 | ChangeInitial full rolling 90-day Cyber Insurance Claims, Coverage & Underwriting Rolling Intelligence Card with Research Framing, Timeline, locked BLUF and Executive Summary, top-ten findings and monitoring table, claims scenarios, market participants, malware, technologies, victimology, lessons learned, AI agent status, connected IntelliOS products, and source-role treatment. | MonitoringWeekly Tuesday material-change review |
Retained Sources and Claim Treatment
| # | Publisher | Published | Publication / Evidence | Why Used / Claim Treatment | Source |
|---|---|---|---|---|---|
| Source2 | PublisherBank for International Settlements, Financial Stability Institute | Published2026-06-17 | Publication / evidenceSource indexofficial | Why used / claim treatmentSupervisory synthesis based on market interviews and desktop review. Used for coverage ambiguity, underwriting, protection-gap, and accumulation-risk context; cited third-party loss figures are not treated as new BIS claims data. | SourceCyber insurance unpacked: the corporate digital safety net https://www.bis.org/fsi/publ/insights75.htm |
| Source3 | PublisherChubb | Published2026-07 | Publication / evidenceSource indexprimary research | Why used / claim treatmentCurrent carrier report using historical claims through December 2025. Frequency and severity figures are cohort- and geography-specific; the publication is in-window, but the underlying losses are not described as 90-day activity. | Source2026 EMEA Cyber Claims Report: Cyber risk, trends and resources https://www.chubb.com/ie-en/business/resources/cyber-claims-report-cyber-risk-trends-and-resources.html |
| Source4 | PublisherNetDiligence | Published2026-06-17 | Publication / evidenceSource indexincident response | Why used / claim treatmentPractitioner synthesis from a private incident-response forum. Used for current identity, help-desk impersonation, SaaS, and broker-control priorities; it is not a statistically representative claims study. | SourceRansomware Advisory Board: Identity-Based Attacks Drive Growing Cyber Risk https://netdiligence.com/blog/2026/06/identity-based-attacks-cyber-brokers-2026/ |
| Source5 | PublisherCybersecurity and Infrastructure Security Agency | Published2026-07-24 | Publication / evidenceSource indexofficial | Why used / claim treatmentCISA's live catalog controls whether a vulnerability has evidence of active exploitation, its federal required-action date, and the catalog's known-ransomware-use field. It does not establish that every exposed policyholder was compromised. | SourceKnown Exploited Vulnerabilities Catalog — active rolling-window extract https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json |
| Source6 | PublisherSonicWall PSIRT | Published2026-07-14 | Publication / evidenceSource indexofficial | Why used / claim treatmentVendor advisory controlling affected SMA1000 models, fixed releases, and active-exploitation status for CVE-2026-15409 and CVE-2026-15410. It is product-risk evidence, not insurance-claim frequency. | SourceSMA 1000 Series Appliances Affected by Multiple Vulnerabilities https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 |
| Source7 | PublisherNational Vulnerability Database | Published2026-07-21 | Publication / evidenceSource indexofficial | Why used / claim treatmentGovernment vulnerability record used with CISA KEV to establish Langflow's unauthenticated code-execution condition and current exploitation status. It does not quantify deployment prevalence or insured loss. | SourceCVE-2026-0770 Detail and KEV Synchronization https://nvd.nist.gov/vuln/detail/CVE-2026-0770 |
| Source10 | PublisherPTC | Published2026-06-18 | Publication / evidenceSource indexofficial | Why used / claim treatmentVendor notice controlling CVE-2026-12569 affected-product, patch, and incident-hunting guidance. CISA separately marks the vulnerability as known ransomware campaign use. | SourceCritical Windchill and FlexPLM Remote Code Execution Notice https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability |
| Source11 | PublisherCanadian Centre for Cyber Security | Published2026-07-16 | Publication / evidenceSource indexofficial | Why used / claim treatmentOfficial partner-government alert used to identify the current on-premises SharePoint exploitation cluster and urgent patching requirement. It does not establish loss or compromise for every SharePoint owner. | SourceCritical SharePoint Server Vulnerabilities — CVE-2026-56164, CVE-2026-55040, and CVE-2026-58644 https://www.cyber.gc.ca/en/alerts-advisories/al26-017-critical-vulnerabilities-impacting-microsoft-sharepoint-server-cve-2026-56164-cve-2026-55040-cve-2026-58644 |
