What types of alerts does Travelers send, and why? 

What types of alerts does Travelers send to policyholders?

When it comes to cyber risk, speed matters. The difference between an inconvenient security issue and a costly breach often comes down to how quickly a threat is identified and resolved.

What Are Alerts, and Why Do They Matter? 

Travelers alerts are real-time email notifications about critical cybersecurity risks detected in a policyholder’s environment. Each alert comes with tailored, step-by-step instructions designed to help your organization reduce exposure and avoid attacks before they escalate. 

A problem many organizations face is one of too much information about threats, rather than too little. It’s common to see automated services that issue alerts about every threat that has been published on a database like the National Vulnerability Database. But seeing hundreds of alerts each month does not help organizations prioritize and act on material threats that are relevant to their IT environment.  

Rather than relying on a single source, our alerts are powered by a combination of: 

• Travelers’ proprietary threat intelligence and scanning tools 

• Data partnerships with top cybersecurity firms 
• Continuous monitoring of the dark web and known vulnerabilities 

Our team reviews data from these sources each day and quickly escalates any findings that may have an impact on policyholders. Our proactive approach ensures that alerts are targeted based on the software or hardware being used by an organization, and that our alerts can be delivered as quickly as possible. This combination of targeting and speed can help your organization prevent or limit the damage of a cyberattack and a costly claim. 

Types of Alerts You May Receive as a Travelers Policyholder

Known Threat Alerts

• What they are: Risks we already understand well and can identify through routine scans (e.g., open RDP, RDWeb, SMB, Telnet). 

• When they happen: Regular monthly scans of your organization’s environment may detect these exposures. 

• Urgency: Medium — we recommend addressing the exposure within 48 hours of receipt.  

• Example: A regular monthly scan reveals an exposed RDP port. The alert includes suggested actions to close web access for that port and/or look for an alternative method of providing remote access.  

• Analogy: It’s as if a routine house check revealed that the lock on a seldom-used door is broken. We instruct them to keep the door deadbolted or change the lock.

 

Emerging Threat Alerts

• What they are: Newly discovered cyber risks, such as zero-day vulnerabilities or credible industry-specific threats. For some threats, these alerts can be targeted based on scan data; others require the team to make inferences about risk based on correlations.  

• When they happen: Variable — typically 1 to 5 times per month. Impact can range from a single client to thousands. 

• Urgency: High (variable) — depends on the threat, but most require prompt attention.

• Example: A zero-day vulnerability is discovered in a specific brand of VPN. We alert all policyholders using that brand of VPN, based on our Cyber Risk Scan data, and advise them to take action.  

• Analogy: It’s like attackers just figured out a new way to break into houses that are just like yours. Time to make sure all your locks are working—quickly. 

Imminent Threat Alerts

• What they are: Urgent, high-stakes threats discovered through dark web intelligence, such as stolen credentials for sale, infostealer infections, or ransomware leak site activity. 

• When they happen: Infrequently — these alerts are individualized, so the likelihood of any given insured receiving one is low.  

• Urgency: Extremely High. These alerts require immediate action. 

• Example: Our threat intelligence team sees stolen access credentials being sold online and informs the policyholder and their agent or broker immediately with suggested actions (including changing their credentials to all accounts).  

• Analogy: It’s like a threat actor already has a copy of your house keys and is offering them for sale to burglary specialists. Our alert is a signal to change the locks immediately. 

FAQ:  

What email will I get alerts from? 

In most cases, alerts will be sent to you directly from a member of our Cyber Risk Services team. In rare cases, if Travelers does not have contact information for your organization, an alert may be sent through your insurance agent or broker.  

What should I do after I receive an alert?  

Each alert email includes next steps that walk you through recommended actions to take based on the type of alert you received. Once you have investigated the issue identified, we request that you let us know that the issue was addressed by emailing us at cyberservices@travelers.com 

Who can I reach out to if I have questions for Travelers? 

We invite you to reach out to us any time at cyberservices@travelers.com  

 

---

Travelers Casualty and Surety Company of America and its property casualty affiliates. One Tower Square, Hartford, CT 06183.  

This material is for general informational purposes only and is not legal advice. It is not designed to be comprehensive and it may not apply to your particular facts and circumstances. Consult as needed with your own attorney or other professional advisor. This material does not amend, or otherwise affect, the provisions or coverages of any insurance policy or bond issued by Travelers. It is not a representation that coverage does or does not exist for any particular claim or loss under any such policy or bond. Coverage depends on the facts and circumstances involved in the claim or loss, all applicable policy or bond provisions, and any applicable law. Availability of coverage referenced in this document can depend on underwriting qualifications and state regulations.  

Cyber customers may receive certain services through external vendors and, if using these services, must agree to the vendors’ terms of use and privacy policies. Travelers makes no warranty, guarantee or representation as to the accuracy or sufficiency of any such services. The use of such services and the implementation of any product or practices suggested by such vendors is at the customer’s sole discretion. Travelers disclaims all warranties, express or implied. In no event will Travelers be liable in contract or in tort for any loss arising out of the use of such services or any vendor products.