Insurance / Cyber insurance (InsurTech) · Deep dive

At-Bay

The 2016 'InsurSec' startup founded by ex-Unit 8200 operators that fused cyber insurance with active attack-surface monitoring, rode the ransomware hard market to a $1.35B unicorn valuation in July 2021, bought its own licensed carrier in 2023, and now bets that pairing policies with a CrowdStrike-powered MDR product produces a loss-ratio edge durable enough to survive competitors copying it and reinsurers repricing cyber.

emerging

The question that decides it: Does At-Bay's active-monitoring loss-ratio advantage — customers it says are up to 5x less likely to suffer ransomware and claims it estimates run at under half the industry average — persist as Coalition, Cowbell and carrier-owned Corvus copy the same scan-and-alert playbook and as reinsurers reprice cyber capacity? If the edge is structural, At-Bay compounds into a category carrier; if it was a hard-market artifact, it becomes a normal MGA competing on price with a thin data moat.

My take ★★ Very interesting ★ Interesting − Maybe ✗ Not interesting

Snapshot

At-Bay is a cyber-insurance company built on a simple bet: that an insurer which continuously watches its customers’ networks can price risk better and pay fewer claims than one that underwrites off a questionnaire once a year. Founded in 2016 by former Israeli-intelligence operators, it began as a managing general agent (MGA) writing on Munich Re capacity, then in January 2023 bought its own licensed carrier to become full-stack. It calls the model “InsurSec” — insurance plus security — and in 2024 pushed further into security by launching a managed detection and response (MDR) product. At-Bay reached a $1.35 billion valuation in July 2021, reported roughly $155M of revenue in 2024, and claims a loss ratio well below the cyber-insurance industry average. It matters now as the clearest test of whether the security-plus-insurance bundle is a structural moat or a hard-market artifact.

Founding story

The company traces to a frustration Rotem Iram formed watching breaches from the inside. After a stint as a captain in Unit 8200 — the Israeli signals-intelligence unit whose alumni populate half of Israel’s cyber industry — plus a computer-engineering degree, a Harvard MBA, and time at McKinsey, Iram ran cyber defense and incident response as COO of the risk-investigations firm K2 Intelligence. There he saw both sides of a cyber loss: companies with no idea how exposed they were, and insurers writing policies against risks they could not measure and then disputing the payouts. His conclusion, formalized when he co-founded At-Bay in 2016 with Roman Itskovich (risk and underwriting) and Etai Hochman (technology), was that the two problems solved each other. An insurer with the incentive to reduce loss, and the security skill to actually do it, could underwrite more accurately, help customers fix problems before they became claims, and keep the resulting margin.

The timing was fortunate and then brutal in a useful way. At-Bay launched into a cyber market that was about to be defined by ransomware. Early backers Lightspeed and Khosla seeded it; a $13M Series A followed in May 2018. Then the 2020-2021 ransomware surge blew up the cyber-insurance market — loss ratios spiked, incumbents fled or repriced, premiums doubled. That dislocation was the making of At-Bay: a company whose entire pitch was measuring and reducing cyber risk suddenly looked prescient, and capital poured in, culminating in the $185M Series D at a $1.35B valuation in July 2021.

How it works

Mechanically, At-Bay is an underwriting-and-security pipeline wrapped around a broker workflow. When a business applies for a policy — almost always through an independent insurance broker, not direct — At-Bay runs an external scan of that company’s internet-facing assets: domains, IP addresses, exposed services, email configuration, known vulnerabilities and misconfigurations. That scan feeds the underwriting decision, so pricing reflects the applicant’s actual observed exposure rather than self-reported answers. Brokers quote, customize and bind on the At-Bay platform, often in minutes.

The differentiator is what happens after binding. At-Bay keeps scanning the insured throughout the policy term. Its Stance platform maintains a risk score that updates as exposure changes, and when the system spots a newly exposed service or a critical vulnerability — a hole an attacker could walk through — it alerts the customer with remediation guidance, ideally closing the gap before it becomes a claim and well before renewal. The economic logic is tight: every intrusion prevented is a claim not paid, which At-Bay keeps as margin and can share back as lower or flat renewal pricing. It advertises coverage features that only make sense if you believe your own risk selection, including automatic flat renewals and zero retention (no deductible) on ransomware and financial-fraud claims for qualifying customers.

Behind the paper, the structure evolved. At-Bay started as an MGA — it underwrote and serviced policies but the actual insurance risk sat on a rated carrier’s balance sheet, historically Munich Re’s HSB (an A++ paper source and an investor). In January 2023 it acquired a Delaware-domiciled excess-and-surplus P&C carrier, renamed At-Bay Specialty Insurance Company, letting it issue policies on its own paper; in 2024 it added an admitted-lines product. That vertical integration captures more economics but also puts more underwriting risk on At-Bay itself.

Product and business overview

At-Bay sells three connected things. First, cyber insurance — first- and third-party coverage across primary and excess layers, on both E&S and admitted paper, aimed primarily at small and mid-sized businesses distributed through brokers, plus specific products for ransomware and financial fraud. Second, active risk monitoring, the continuous external scanning and alerting bundled free with policies, which is the “Sec” in InsurSec and the operational heart of the loss-ratio claim. Third, and newest, At-Bay Stance MDR — a managed detection and response service launched October 2023 and made broadly available from January 2024 through its At-Bay Security affiliate. Stance MDR pairs CrowdStrike endpoint detection with a 24/7 At-Bay security operations center that hunts and responds to threats on customers’ actual machines. Its rationale is drawn straight from claims data: At-Bay estimated that more than half of its customers’ cyber claims could have been mitigated by effective MDR. MDR turns At-Bay from a company that watches the perimeter into one that can act inside the network — and adds a software revenue line that is not dependent on insurance capacity.

Business model and pricing

Revenue comes from two engines. On insurance, At-Bay earns underwriting profit and fee/commission economics on the premium it writes — increasingly on its own carrier, which means it keeps more of the margin but also bears more of the loss. On security, MDR is a subscription sold alongside (or independent of) policies. There is no public rate card; cyber premiums are quoted per account based on revenue, industry and the external-scan risk profile, and MDR is priced as a per-seat/per-endpoint managed service. The commercial claims are the pitch: At-Bay says its security work makes customers up to five times less likely than the industry average to suffer a ransomware attack, and that its resulting loss ratio runs at less than half the industry average — a decisive advantage if true, because in insurance the low-loss-ratio writer can either out-earn or under-price everyone else. The whole model, however, rests on capacity: an MGA (and even a small carrier) depends on reinsurers to absorb the tail, and cyber’s correlated, catastrophe-like risk means reinsurance appetite and pricing can swing hard against it.

Traction over time

The shape: explosive premium growth through the 2021-2022 ransomware hard market, then a more normal growth rate as cyber pricing softened in 2023-2024, with MDR emerging as the fastest-growing line off a small base. Note the tension in the premium figures — a reported ~$380M annualized GWP in 2022 sits awkwardly next to ~$301M of gross premiums written in 2023, reflecting both softening cyber rates and different definitions across trackers; treat the exact premium series as directional, not audited. The valuation itself has an asterisk: the $1.35B is a 2021 mark, and third-party trackers imply a lower ~$1.1B figure since, with no new priced round to reset it.

Market analysis

Cyber is the fastest-growing meaningful line in insurance. Munich Re pegged global cyber gross premiums at roughly $16.3B in 2025 and expects them to roughly double by 2030 at a double-digit annual growth rate; MarketsandMarkets models ~$16.5B in 2025 rising to ~$32.2B by 2030 (a ~14% CAGR). The structural driver is that cyber insurance still represents under 1% of global property/casualty premium against a threat that grows every year — a large protection gap that expands as ransomware, business-email compromise and supply-chain attacks push more SMBs to buy coverage. That is genuine tailwind. The catch specific to At-Bay’s model is that cyber is also uniquely cyclical and correlated: a single widespread exploit can hit thousands of insureds at once, loss ratios swing violently, and reinsurers periodically pull back capacity or reprice it. The 2020-2021 hard market that made At-Bay also proved how quickly the category’s economics can invert.

Competitive intel

The field is crowded with companies selling nearly the same sentence. Coalition is the direct and larger rival — the scale leader in “active insurance,” better funded (a ~$5B peak valuation) and attacking the same broad middle. Cowbell presses from below with automated micro-SMB underwriting; Resilience presses from above with enterprise risk quantification. The most instructive competitor is Corvus, the tech-forward cyber MGA that Travelers acquired in 2024: it demonstrated that a large rated carrier can simply buy the scan-and-score toolkit and pair it with capital, ratings and distribution an independent MGA cannot match. Behind all of them sit the incumbents — Chubb, Beazley and the rest — who write most of the world’s cyber premium and, having re-underwritten cyber through 2022-2024, are now better at risk selection than they were when At-Bay’s edge looked unique. At-Bay’s defensible ground is the combination: years of scan-plus-claims data feeding underwriting, a genuinely differentiated MDR upsell, and a broker franchise. The open question is whether that combination stays ahead of a dozen well-capitalized copies.

History and evolution

• 2016 — Rotem Iram, Roman Itskovich and Etai Hochman found At-Bay; the thesis is insurance plus security (“InsurSec”).
• 2017 — Seed round (~$6M); begins writing cyber policies as an MGA on Munich Re/HSB capacity.
• May 2018 — $13M Series A co-led by Khosla Ventures and Lightspeed.
• February 2020 — $34M Series B led by Acrew Capital and Munich Re Ventures.
• December 2020 — $34M Series C; Microsoft’s M12 joins as a new investor.
• July 2021 — $185M Series D at a $1.35B valuation, co-led by Icon Ventures and Lightspeed; At-Bay becomes a unicorn.
• October 2021 — $20M Series D extension (ION Crossover Partners), round to $205M, valuation unchanged.
• August 2022 — Acquires distribution platform Relay to expand into broader specialty insurance.
• January 2023 — Acquires a licensed Delaware E&S carrier (At-Bay Specialty Insurance Company), moving from pure MGA toward full-stack carrier.
• October 2023 / January 2024 — Launches At-Bay Stance MDR (CrowdStrike EDR + 24/7 SOC); broadly available from January 2024.
• 2024 — Shutters the Relay distribution platform to refocus on core InsurSec and MDR; adds an admitted-lines cyber product; revenue ~$155M; MDR reaches ~$13M ARR / ~7,500 customers. Named to Forbes’ Fintech 50 for a second year.

What people say

The case for. Brokers and trade press consistently credit At-Bay for the parts of the model that are hard to fake: an in-house claims team, a genuinely below-market loss ratio, and customer-friendly features like automatic flat renewals and zero retention on ransomware and financial-fraud claims that only a confident underwriter would offer. The recurring theme in coverage is that At-Bay behaves like a security company that happens to sell insurance — the active-monitoring alerts are described as actually useful rather than a marketing gloss, and the MDR launch is treated as a logical extension backed by its own claims data (more than half of claims deemed preventable with MDR). Forbes has twice named it to its Fintech 50, and Munich Re’s continued involvement is a real-money vote of confidence in the underwriting.

The complaints. On the employee side, Glassdoor sits around 3.8/5 with roughly 71% recommending, but the negative reviews cluster on management, not mission: recurring gripes about unclear and constantly shifting priorities (“everything is a priority”), below-market pay for support and operations staff, layoffs of good people despite reported growth, and overwork. That is a company that expanded fast and is now managing the hangover. On the business side, the deeper criticisms are structural rather than review-site: the $1.35B valuation is a 2021 hard-market mark that trackers now imply has drifted lower to ~$1.1B with no fresh round to confirm it; cyber’s loss-ratio cyclicality means a soft market or a single systemic event could compress the margin the whole model rests on; and the MGA/small-carrier structure leaves At-Bay dependent on reinsurance appetite it does not control. The loudest strategic complaint is simply that its edge is copyable — Coalition, Cowbell, Resilience and now Travelers-owned Corvus all sell some version of scan-plus-insure.

Outlook: the open question

The whole investment case reduces to one measurable thing: whether At-Bay’s loss-ratio advantage is structural or cyclical. If it is structural — if continuous scanning, years of paired scan-and-claims data, and now MDR genuinely make its book lose money less often than rivals’ — then At-Bay compounds into a category carrier, because in insurance a durable low-loss-ratio writer can out-earn or under-price everyone indefinitely, and the MDR line gives it a software attach that deepens the moat and diversifies away from pure underwriting. For that bull case to be true, three things have to hold: the loss-ratio gap must persist through a soft cyber market (not just the 2021-2022 hard one that made the company), the data edge must stay ahead of Coalition and the carrier-owned copies, and reinsurance capacity must remain available at prices that leave At-Bay its margin.

For the bear case, the mechanism is equally concrete: the edge was partly a hard-market artifact, competitors and rated incumbents replicate the scan-and-alert toolkit (Travelers buying Corvus is the proof of concept), and as cyber rates soften and reinsurers reprice correlated cyber risk, At-Bay’s advantage narrows to a normal MGA competing on price with a thinner-than-advertised data moat and a valuation still anchored to a 2021 peak. The tell to watch is the loss ratio itself across a full soft-market cycle, MDR’s growth beyond its ~$13M-ARR base, and whether At-Bay raises a fresh priced round that confirms or resets the $1.35B mark. Everything else — headcount, product launches, awards — is noise around that single number.

How a challenger would attack it

Attack the capacity dependency and the stale mark, not the scanner. The scan-and-alert toolkit is no longer an edge — Coalition, Cowbell and Travelers-owned Corvus all run some version of it — so a challenger wouldn’t out-scan At-Bay; it would out-structure it. At-Bay carries a 2021 valuation mark ($1.35B) that trackers already imply has slipped to ~$1.1B with no fresh priced round, which constrains its ability to raise and spend into a price war. A challenger raising at today’s terms can under-price the broad-middle SMB book precisely when soft cyber rates are compressing everyone’s margin, forcing At-Bay to choose between defending share and defending the loss ratio its entire story rests on. The sharper technical attack: At-Bay’s monitoring is external-perimeter scanning, and its own claims data says more than half of claims were preventable with MDR — inside-the-network telemetry. A challenger that starts from an EDR install base (the CrowdStrike position At-Bay rents rather than owns) inverts the model: security company first, insurance attached, with far richer signal per insured. Finally, target the reinsurance chokepoint — At-Bay’s small carrier still needs reinsurers to absorb cyber’s correlated tail, and a challenger backed directly by a large carrier balance sheet, Corvus-style, never has that fragility.

Same playbook, new buyer

The InsurSec bundle is a template for any insurable risk you can instrument. At-Bay’s real invention is continuous telemetry feeding underwriting, with margin recycled into prevention. Cyber was the first vertical; the same loop works wherever sensors are cheap and losses are behavioral: commercial fleet (dashcam and telematics data pricing auto liability), commercial property (IoT water and fire sensors — the leading cause of preventable claims), and workplace injury (wearables feeding workers’ comp). A geographic shift is equally live: At-Bay is US-broker-distributed, while Europe’s SMB cyber protection gap is at least as large, with GDPR fines adding a loss driver US books lack and no entrenched active-insurance player at scale. At-Bay is unlikely to follow into any of these. Its ~362 people and ~$155M revenue are consolidating around cyber plus MDR after already retreating from adjacency once — it bought the Relay platform in 2022 to expand into broader specialty insurance and shuttered it by 2024. Its data moat, claims team and broker relationships are cyber-specific, and its capital position doesn’t fund a second land grab.

Sources and further reading

• Cyber Insurance Startup At-Bay Closes $185 Million Series D, Valuing Company at $1.35 Billion — At-Bay, July 27, 2021. Round size, co-leads (Icon, Lightspeed), $1.35B valuation.
• At-Bay Closes $20M Extension to Series D; Adds Investor ION Crossover Partners — At-Bay, October 2021. $20M extension to $205M, valuation held at $1.35B.
• Cyber Insurance Startup At-Bay Secures $13M Series A Funding Co-Led by Khosla Ventures and Lightspeed — Business Wire, May 9, 2018. Series A terms.
• Cyber insurance startup At-Bay raises $34M Series C, adds M12 as a new investor — TechCrunch, December 8, 2020. Series C and M12.
• How Two Former Spies Cracked The $11 Billion Cyber Insurance Market — Forbes, February 12, 2024. Founder background, model, scale.
• At-Bay Acquires Licensed P&C Insurance Carrier — Insurance Journal, January 24, 2023. Move from MGA to full-stack carrier.
• At-Bay Launches New Managed Detection and Response (MDR) Cybersecurity Solution for SMBs — Business Wire, October 26, 2023. Stance MDR, CrowdStrike, “50%+ of claims preventable.”
• At-Bay Revenue 2024: $155M ARR, $1.1B Valuation — GetLatka, updated August 2026. Revenue, headcount and valuation estimates.
• Cyber Insurance Market Size Expected to Soar: Munich Re — Insurance Journal / Munich Re, April 2025. ~$16.3B 2025 market, doubling by 2030.
• Coalition, At-Bay, Cowbell, Corvus, Beazley: cyber insurance carrier comparison — SeedPod Cyber, 2025-2026. Competitive positioning by segment.
• At-Bay Reviews — Glassdoor, 2026. 3.8/5, ~53 reviews, employee complaint themes.