.png)
At a recent ProSight Wisconsin Chapter event, I joined a panel of attorneys, regulators, and other industry voices to share "scary stories" from our work. Mine come from cybersecurity, and most of them start with a single click or a security setting someone decided they didn't need.
What are the biggest cybersecurity risks for businesses right now?
From what our team sees, the biggest risks right now are:
- Skipping multi-factor authentication (MFA).
- Business email compromise (BEC), which has probably been the most widely present attack vector over the last 18 to 24 months.
- End users who click and never tell anyone.
- Cyber insurance policies and backups that attackers can reach on your network.
Cyber insurance applications have become a final exam
A couple of years ago, a cyber insurance application was a one-page softball. You answered a handful of questions and you were done. Now it feels like a final exam, where answering five questions the wrong way means you may never see a policy or a payment.
One of the things carriers keep asking about is MFA. Plenty of people are still ignoring it.
What happens when you skip MFA?
MFA is multi-factor authentication: that six-digit code. A relatively new client came into our care and was adamant they didn't need it. They weren't a bank. They weren't highly regulated.
On a random Friday morning, the owner called us. His whole team was locked out of their machines. Huntress, one of the tools we had in place to protect them, had isolated every machine from the rest of the network. Someone had hacked their way through the firewall because of that missing MFA.
The owner was in his duck blind that morning. We texted back and forth while I explained what was going on and that they'd be down for a bit while we unwound the mess. It was a hard conversation. It also made the next one very easy: why you put these controls in place.
What is business email compromise?
Business email compromise is an attack where a bad actor gets into a real business email account and uses it. It usually starts with a phishing email. You click a link, land on a fake spoof page, and enter your credentials. The attacker sits in the middle, grabs those credentials, and logs into the real account.
With so many organizations on Microsoft 365 for email, BEC has become very common. It also spreads fast, sometimes within seconds. Attackers figured out quickly that one compromised user is a one-to-many attack vector, and it keeps going from there.
Who gets targeted by business email compromise?
Executives and finance teams are prime targets. Anyone at the C level has more decision-making authority. In the finance area of larger companies, invoices go out on a regular basis, and an attacker can fake one and add a redirect to a payment address that isn't part of the normal process.
I gave a talk like this to a home builders association up in the North Woods of Wisconsin. There were probably 75 or 80 people in the room. As they started to understand the threat, they all seemed to have stories to share. One builder stood up, introduced himself, and said a homeowner thought he'd sent them a draw request. They lost $40,000.
Cyber risk in lending: an indirect threat for banks
I spent about a decade in banking. One thing I've always been curious about is the indirect threat to an institution: how well are you assessing the cybersecurity profile of the businesses you lend to?
Take a large manufacturing firm with a huge line of credit that's heavily leveraged. If they go through a ransomware or BEC event that takes them offline for a while, what does that do to their ability to repay their obligations and keep up production?
Why is the end user the biggest cybersecurity risk?
Honestly, the scariest thing in our universe is often an end user. People are trusting at a DNA level. We're just trying to help.
The phishing attempts that start these attacks lean on that trust and add a sense of urgency. The message looks like it's coming from the CEO, the CFO, or the COO: hurry up and get this done. You've got 87,000 other things to do today, you trust it, you click, and that's where it all begins.
Attackers are also using the same AI tools we use to be more efficient: Claude, ChatGPT, Copilot. Their messages look better and sound like a real human wrote them. The prince offering you $2 million for a $49.95 transaction fee, full of odd capitalization and misspellings, is long gone. Today's phishing emails are convincing.
So our side of this goes beyond configuring technology. It's about injecting a moment of pause into the user, so they stay diligent with every click without being paralyzed by it.
What happens when a click goes unreported?
The worst version of the scary story is the user who clicks, the system doesn't detect it, and the user never tells anyone, even though the email smelled funny and checked all the boxes.
At my first bank, the CFO called me into his office one day. He'd gotten a weird email on Tuesday. It was Friday. The email was about the company American Express account, so he clicked and tried to log in. We had a corporate Visa. He was the CFO, paying that bill every month. Had it been something more serious, that three-day wait could have been costly.
Attackers are patient. Once someone clicks and they get in, they can sit and watch your normal activity, then figure out how to evade detection and act at a time, or on a PC, that goes unnoticed. The average attack can sit undetected for upwards of six months before an IT team sees the activity.
Defensive tools have shortened that timeline. They can isolate a threat on our behalf, so nobody has to sit up all night watching a screen. Users still have to report what they see. If you see something, say something. Asking IT to check something out, even just to run a preventative scan, takes a lot of the anxiety out of the situation.
Who should you call first after a cyber attack?
Several years ago, your first call would have gone to your technology department or your MSP. Your first call may still go to your internal tech team. The second call goes to your cyber insurance carrier to report the incident, because that claim starts quickly. More and more, your team is there to enable the carrier's response team.
Where should you keep your cyber insurance policy?
If there's one piece of advice to take back, especially regarding ransomware: never store your cyber insurance policy on the network. Ever.
It's the first thing attackers look for. I've heard enough of these stories over the years. A company has a $5 million limit on its policy. The attackers demand a $10 million ransom, and then magically settle on $5 million.
How do you protect backups from ransomware?
Smaller insurance carriers have called on us over the years to help with these situations. The story usually starts with an organization that has good backups. Once attackers find the insurance policy, step two is to crypto-lock the backups, which hamstrings you on the question of whether to pay.
So over the last handful of years, the next question has become: do you have an immutable backup structure? That means often through an online portal that's completely disconnected from your network. It may not get you fully operational again, but it gives you critical data recoverability and a way to get the mission-critical systems back up and running.
Why sharing these stories matters
If you think the bad guys are working alone in a bubble, think again. They use dark web chat forums, similar to Reddit, to share what works. When we've walked clients through the dark web in demos, you can find threads that lay out how they got someone to click, the exact message they used, the cadence, and when the victim paid.
That sharing network is why we've heard of companies getting hit, then hit again several weeks later by a completely different attack. Events like this one, where people talk, ask questions, and share their own stories, are how the rest of us keep up.
Talk with StrataDefense
If any of these stories sound close to home, reach out to the StrataDefense team at stratadefense.com/contact-us or call (715) 842-7665.
Cybersecurity scary stories FAQ
What is business email compromise (BEC)?
A BEC attack usually starts with a phishing email that sends a user to a fake login page. The attacker captures the credentials, logs into the real email account, and uses it to spread the attack or redirect payments, such as a faked invoice with a new payment address.
Do small, unregulated businesses need MFA?
Yes. One StrataDefense client insisted it didn't need MFA because it wasn't a bank or highly regulated. An attacker got through its firewall because of that gap, and every machine had to be isolated from the network.
Who should you call first after a cyber attack?
Your internal tech team or MSP is often the first call. The second goes to your cyber insurance carrier to report the incident, because the claim and the carrier's response team move quickly.
Should a cyber insurance policy be stored on the network?
Never. Attackers look for it first. Knowing your coverage limit lets them shape their ransom demand around it.
What is an immutable backup?
An immutable backup structure keeps backups often through an online portal completely disconnected from your network, so attackers on your network can't crypto-lock them. It gives you a path to recover mission-critical data.
How long can attackers go undetected?
The average attack can sit undetected for upwards of six months before an IT team sees the activity. Attackers use that time to watch normal activity and learn how to avoid detection.
Why are phishing emails harder to spot now?
Attackers use AI tools like Claude, ChatGPT, and Copilot to make messages look and sound like a real person wrote them. The obvious scams and misspellings of the past are largely gone.