Insurance / Cyber MGA + active insurance platform · Deep dive

Coalition

The $5B Series F cyber-insurance MGA that turned continuous vulnerability scanning into an underwriting weapon and just absorbed Allianz's global commercial cyber book — now with Chubb, Travelers (via Corvus) and Beazley shipping their own native scanners at renewal and Munich Re owning At-Bay, the AI-native wedge is racing commoditisation.

emerging

The question that decides it: **Does Coalition's continuous-scanning + incident-response bundle keep its reported ~70%-fewer-claims and structurally lower loss-ratio advantage** as Chubb, Travelers and Beazley ship native scanners AND buy the response layer (Travelers already bought Corvus November 2023 for $435M, Munich Re acquired At-Bay in 2025 for ~$575M enterprise value), or does the AI-native moat commoditise into a table-stakes broker feature by 2027 — leaving Coalition a distribution and claims-service business trading at a fraction of the July 2022 $5B mark?

My take ★★ Very interesting ★ Interesting − Maybe ✗ Not interesting

Snapshot

Coalition is the San Francisco cyber-insurance MGA that convinced global carriers, brokers and $5B of venture capital that cyber risk should be underwritten the way security teams manage it: continuously scanned, actively remediated, and bundled with 24/7 incident response rather than sold as a static annual policy. Founded March 2017 by Joshua Motta (ex-CIA cyber analyst, ex-Cloudflare, ex-Goldman) and Lookout founder John Hering, it has raised ~$800M cumulative through a July 2022 Series F at $5B led by Allianz X and Valor. It writes on a capacity panel of Allianz, Swiss Re Corporate Solutions, Arch, Lloyd’s, Ascot and its own Bermuda reinsurer Ferian Re, and since 2023 holds its own admitted paper via Coalition Insurance Company. In May 2026 Allianz announced it was transferring its global commercial cyber portfolio to Coalition — the deal Motta says makes Coalition the largest writer of cyber insurance globally. Whether the AI-native underwriting wedge holds now that Travelers owns Corvus and Munich Re owns At-Bay is the entire story.

Founding story

Motta’s biography reads like a recruiter’s fever dream: Microsoft at 15, CIA cyber program at 19 (reportedly the youngest holder of TS/SCI at the time), Goldman Sachs technology investment banking in London, then employee ~20 at Cloudflare running Special Projects. A.B. from the University of Chicago. Motta co-founded the security studio Redacted in 2016 with John Hering and ex-Facebook CSO Max Kelly. The thesis split in late 2017: Kelly wanted enterprise security tooling; Motta wanted insurance, arguing a carrier sitting on live claims and telemetry could price and prevent risk in ways SaaS could not; Hering agreed. Motta and Hering spun Coalition out and debuted December 2017 with capacity from Swiss Re Corporate Solutions and Argo. The pitch: pre-bind attack-surface scan, mid-policy vulnerability alerts, in-house claims and incident response, and a digital quote-and-bind the specialty carriers were structurally too slow to replicate.

How it works

A broker submits an applicant (domain, IP block, revenue, industry). Coalition’s Active Data Graph runs a real-time internet scan of the external attack surface — open ports, exposed RDP, vulnerable Fortinet/Ivanti appliances, mail-server misconfiguration, leaked credentials — and returns a bindable quote in minutes with class pricing plus a per-applicant risk adjustment. Post-bind, Coalition Control continuously scans policyholders (reportedly 65,000 times per week across the book) and pushes vulnerability alerts, patch guidance and, for zero-days like FortiOS or MOVEit, active outreach from Coalition security engineers. When a claim hits, the Security Incident Response Team (SIRT) — roughly 200 responders and forensics staff by 2025 — coordinates forensics, ransom negotiation, notification counsel and business-interruption reconstruction. Coalition claims this bundle drives roughly 70% fewer claims than the broader cyber market.

Product and business overview

• Active Cyber Insurance — first-party (BI, ransom, forensics, FTF) and third-party (privacy, regulatory, media); SMB and mid-market, U.S. enterprise limits up to $25M as of 2026.
• Active Executive Risks — D&O, EPLI, fiduciary, cross-sold into the cyber base.
• Coalition Control — the policyholder-facing scanning and remediation portal.
• Coalition SIRT — 24/7 incident response bundled with policy; also sold standalone.
• CoalitionAI — April 2023 GenAI assistant for brokers and businesses.
• Coalition Insurance Company — wholly-owned admitted carrier, all 50 states + DC, A- rated (AM Best); acquired via Digital Affect (Munich Re Digital Partners) in 2022 and re-launched Jan 2023.
• Ferian Re — Bermuda Class 3B reinsurer, ~$300M capitalisation Oct 2022 with BDT Capital Partners and The Pritzker Organization.
• Coalition Re — reinsurance intermediary.
• Wirespeed (2026 acquisition) — bolted automated detection and response.

Distribution is 100% broker — ~60,000 appointed brokers by 2024-2025.

Business model and pricing

Coalition earns three ways: MGA commission on ceded premium (typically 25-30% plus contingent profit-share tied to loss ratio); underwriting profit on premium retained by CIC since 2023; and small revenue from standalone IR engagements. Real pricing (2025): a $1M limit for a $10M-revenue professional-services SMB runs ~$2,500-$6,000; a $5M limit for a $100M mid-market manufacturer $25,000-$60,000; enterprise limits ($10-25M) reach six figures. Broker commission is 15-20%; residual cedes to the capacity panel.

Traction over time

Figures from Coalition announcements, Insurance Journal, TechCrunch, PitchBook, Tracxn.

Market analysis

Global cyber insurance direct written premium sits at roughly $16-17B in 2025 (Munich Re, Swiss Re Institute) and is projected to reach $28-30B by 2028 as SMB penetration deepens and mid-market limits scale. Three forces move it: (1) loss severity is normalising after the 2020-2021 ransomware spike — Coalition’s own 2025 Claims Report showed frequency down 7% YoY, ransomware severity down 7% to $292,000 average, and ransom demands down 22% to $1.1M, unwinding the 2022-2023 margin tailwind; (2) BEC and funds-transfer fraud (60% of Coalition’s 2024 claims mix) dominates frequency in a way that rewards email-security tooling more than perimeter scanning; (3) systemic risk — CrowdStrike-style single-vendor outages, MOVEit-style supply-chain events — is pressuring reinsurance capacity for aggregation limits and pushing carriers toward tighter war/state-actor exclusions.

Competitive intel

• Corvus (Travelers) — direct AI-underwriting analogue, now backed by Travelers’ AA balance sheet and $40B+ NPW franchise; cross-sells against property, casualty and BOP incumbency.
• At-Bay (Munich Re) — second AI-underwriting analogue inside the world’s largest reinsurer, which prices at reinsurance cost-plus and gives At-Bay an expense-ratio edge Coalition cannot match.
• Cowbell Cyber (Zurich-backed) — attacks Coalition on the SMB end via continuous underwriting on Zurich’s balance sheet.
• Chubb Cyber, Beazley Breach Response, AXIS Cyber — legacy specialty carriers shipping native scanners and pre-bind risk-engineering to blunt Coalition’s differentiation at renewal.

The uncomfortable read: the $435M Corvus and ~$575M At-Bay exits cleared the market at roughly one-tenth Coalition’s $5B Series F implied scale. Credible buyers today are Allianz, Chubb, Zurich or Munich Re — and Munich Re just published what it will pay.

History and evolution

• March 2017 — Coalition incorporated by Motta and Hering out of Redacted.
• December 2017 — Public launch with Swiss Re and Argo capacity.
• 2018-2022 — Seven priced rounds Seed through Series F; $5B mark July 2022 (see funding table).
• October 2022 — Ferian Re launched with BDT + Pritzker; ~$300M capitalisation.
• January 2023 — Coalition Insurance Company launched as admitted carrier.
• April 2023 — CoalitionAI launched.
• November 2023 — Travelers announces $435M acquisition of Corvus (closes Jan 2024).
• January 2024 — Coalition confirms elimination of inside-sales roles.
• March 2025 — ~$30M PE extension reported.
• 2025 — Munich Re acquires At-Bay at ~$575M EV.
• May 2026 — Allianz Commercial announces global cyber portfolio transition to Coalition.
• July 2026 — Enterprise limits to $25M; Wirespeed acquired.

What people say

The case for. Broker feedback in Insurance Journal, PropertyCasualty360 and aggregators is consistently strong on quote turnaround, submission responsiveness and SIRT service — brokers cite “the fastest first-party quote in cyber” and post-claim service as the stickiness driver. Coalition’s Claims Reports produce numbers reinsurers and regulators take seriously: 60% BEC/FTF share of 2024 claims, $115K average loss, 70% claims-frequency delta for Coalition policyholders. Glassdoor sits at 3.7/5 with 74% would-recommend; positive reviews cite mission, product and executive accessibility. AM Best affirmed CIC’s A- rating in March 2024. The Allianz deal is the loudest exogenous endorsement: the world’s largest cyber carrier chose to hand its book to Coalition rather than build.

The complaints. Negative Glassdoor reviews cluster on the January 2024 sales-team restructuring Coalition described as narrow but former US account executives disputed publicly, plus recurring micromanagement, aggressive performance-management, and pockets of leadership tone called “toxic”. Analysts argue the “70% fewer claims” is a book-mix effect — Coalition writes SMB accounts filtered through pre-bind scans while incumbents wrote everyone; now every carrier runs pre-bind scans and the differential collapses. Loss ratios normalising is the quiet risk: the 2022-2023 vintage was written at ~200% premium adequacy; 2025-2026 renewals are giving that back, and MGA profit-share is directly geared to loss-ratio outcomes on ceded premium. Ferian Re and CIC retained-risk look meaningful in a benign year and existential in a correlated one — a Fortinet, MOVEit or CrowdStrike-scale event could produce simultaneous claims across a large fraction of the book. And the $435M Corvus and ~$575M At-Bay exits are the elephant in every LP’s boardroom: no priced VC round has stamped a new Coalition mark since July 2022.

Outlook: the open question

The answer conditions. Coalition compounds if three things hold through 2027: (1) the loss-ratio delta between actively-scanned and unscanned books stays at least 5-8 points once every carrier ships a native scanner, meaning Active Insurance is a workflow-and-response moat rather than pre-bind data; (2) the Allianz global-portfolio transition converts cleanly — Coalition inherits profitable underwriting economics rather than adverse-selected renewal accounts Allianz was happy to shed; and (3) a systemic correlated cyber event does not hit before Coalition builds enough retained capital and reinsurance protection to survive one. Coalition fails or exits at a distressed mark if any breaks. The Corvus and At-Bay multiples ($435M and ~$575M) are the floor case investors would rather not benchmark to but almost certainly are.

How to attack it

The wedge is not “another AI cyber MGA on Bermuda paper” — Corvus, At-Bay, Cowbell and Resilience each priced that model, and marginal capacity is in strategic hands. The wedge is MSP-embedded and vertical-SaaS-embedded SMB cyber: a de novo MGA distributing cover through the MSP channel (ConnectWise, Kaseya, Datto, Pax8) and vertical-SaaS platforms (Toast, Vagaro, ServiceTitan, Squire) rather than appointed brokers. The MSP or SaaS platform becomes the underwriting risk sensor — endpoint telemetry, patch cadence, MFA enrolment, backup verification — with fronted paper (Accelerant, Skyward, Clear Blue) carrying the balance sheet. That attacks Coalition’s SMB flank in exactly the segment its January 2024 restructuring exposed: below the $10M-revenue attach where Coalition needed a large inside-sales bench, an MSP-embedded quote is $500-2,500 annual attach with zero marginal distribution cost.

Exploitable weaknesses:

• Broker dependence. ~100% of distribution runs through appointed brokers; MSP and vertical-SaaS channels are structurally outside that. Brokers never see the MSP quote.
• Loss-ratio commoditisation. Chubb, Beazley, Travelers-Corvus and Munich Re-At-Bay have shipped or will ship native scanners with paper attached; Active Insurance workflow becomes table stakes.
• Retained-risk concentration. Ferian Re + CIC own more of the tail than most observers appreciate; correlated events (cloud vendor outage, single-CVE mass exploitation) can produce claim spikes above modelled aggregation limits.
• Layoff and culture stress. The January 2024 restructuring produced public-domain criticism from displaced US AEs and consistent Glassdoor tone about post-2023 management; a well-funded attacker can hire the disaffected mid-tier.
• Exit-multiple compression. Corvus $435M and At-Bay ~$575M reset the strategic ceiling for the category; any raise below the $5B 2022 mark would be a public reset — Coalition is capitally constrained relative to fresh entrants.
• Regulatory framing. State DOI cyber-MGA oversight is increasing under NAIC frameworks; a fresh attacker on fully-fronted paper faces less scrutiny than Coalition’s captive-plus-admitted-plus-MGA hybrid.

Adjacent-segment play

Coalition’s core capability — live-telemetry underwriting + in-house incident response + admitted paper — could be repackaged four ways. First, E&O for tech-forward SMBs: apply continuous-monitoring underwriting to professional liability for SaaS vendors and MSPs, using GitHub activity, SOC 2 posture and customer telemetry; Vouch and Embroker occupy corners but no one has combined Coalition-grade scanning with E&O paper. Second, AI-vendor and model-risk cover: as Coalition Control’s scanning surface expands into third-party AI dependencies, productise “AI liability” for enterprises deploying LLM agents — a line At-Bay has explicitly targeted post-Munich Re. Third, international SMB cyber outside Anglophone markets: Germany, France, Japan, Brazil and Mexico are structurally under-penetrated, and Allianz is now the distribution partner. Fourth, security-vendor OEM / white-label: license Coalition Control’s scanning + risk-rating engine to MSPs, security vendors (Sophos, Arctic Wolf, Huntress) and identity platforms — a fee-income stream uncorrelated with underwriting cycles. Not attractive: personal-lines cyber — dominated by Allstate / Aura / IdentityIQ, LTV too thin, signal set completely different from the commercial attack-surface model that is Coalition’s actual moat.

Sources and further reading

• Coalition Closes Series F Funding Round of $250 Million, Coalition, July 2022
• Cyber Insurance Firm Coalition Raises $250M at $5B Valuation, SecurityWeek, July 2022
• Coalition Launches Coalition Insurance Company, Coalition, January 2023
• Coalition and BDT Capital Partners Launch Ferian Re, Insurance Journal, October 2022
• Coalition 2025 Cyber Claims Report Finds Ransomware Stabilized, BusinessWire, May 2025
• Coalition and Allianz Commercial Expand Strategic Global Cyber Insurance Partnership, Coalition, May 2026
• Travelers to Acquire Corvus for $435 Million, SecurityWeek, November 2023
• Munich Re Agrees to Acquire Cyber Insurtech At-Bay in $575m Deal, Reinsurance News, 2025
• Cyber insurance startup Coalition plots global expansion, TechCrunch, July 2022
• Coalition Reviews on Glassdoor, Glassdoor, accessed 2026
• Cyber insurance business Coalition cuts sales team, Insurance Business America, January 2024