Insurance · Deep dive

Coalition

A cyber-insurance MGA that scans every policyholder's internet-facing attack surface, warns them before attackers strike, and increasingly carries the risk on its own balance sheet — 'active insurance' as a wedge to take over incumbents' cyber books, most dramatically Allianz's.

emerging

The question that decides it: Coalition's whole thesis is that continuous attack-surface scanning produces structurally lower loss ratios than static underwriting — and its 2026 deal to absorb Allianz's global cyber book, backed by 10-year capacity plus equity, is the ultimate test. Does active insurance actually price and prevent cyber risk better than a legacy carrier at enterprise scale — or is Coalition just an underwriting outsourcer whose retained balance sheet (Palekana captive, Ferian Re) gets caught the year a single cloud or software-supply-chain event turns cyber into a correlated catastrophe?

My take ★★ Very interesting ★ Interesting − Maybe ✗ Not interesting

Snapshot

Coalition sells cyber insurance the way a security company would run it. Rather than underwriting a business once off a paper application, it continuously scans every policyholder’s internet-facing attack surface, alerts them when a new exposure or zero-day appears, and helps fix it before an attacker gets in — a model it brands “Active Insurance.” It operates primarily as a managing general agent (MGA) — pricing, binding and handling claims while large carriers put up the balance-sheet capacity. By 2023 it was the largest cyber writer in North America by gross written premium, wrote roughly $630 million that year, and said it was “approaching a billion dollars” of annualized premium by April 2024. It last priced at a $5 billion valuation in July 2022. The defining moment came in May 2026, when Allianz — a Series F investor — agreed to hand Coalition its entire global commercial cyber book, making the startup the exclusive underwriter of one of the world’s largest insurers’ cyber portfolio.

Founding story

Coalition’s origin is a disagreement about what to build. In 2016 Joshua Motta co-founded a security studio, Redacted, with John Hering (founder of mobile-security firm Lookout) and Max Kelly (Facebook’s former CSO). Kelly wanted to build security tech for enterprises; Motta was fixated on a different lever — insurance, arguing that cyber insurers had sold policies for two decades while understanding almost nothing about the actual security posture of the companies they covered. They underwrote blind. Hering and Motta spun Coalition out and announced it in December 2017 with ~$10 million from Vy Ventures, Ribbit Capital and Valor Equity Partners.

Motta is the engine, and his résumé fits the pitch: a first business sold to Microsoft as a teenager, the CIA’s cyber program at 19, tech investment banking at Goldman Sachs in London, and an early special-projects role at Cloudflare. The founding conceit — that intelligence-community-grade security people could select and mitigate risk better than a traditional carrier — is what let Coalition raise venture money against a category generalist insurers found unprofitable.

How it works

Follow one policy. When a broker requests a quote, Coalition doesn’t just read an application — it runs an Active Risk Assessment, scanning the applicant’s IP addresses, domains, open ports and assets and scoring the exposure. Because it’s automated, Coalition can rate, quote and bind without a human underwriter on most SMB accounts. Once live, the platform (Coalition Control) keeps scanning through the term — Active Protection. When it spots a newly exposed service, an unpatched system, or a tracked zero-day, it pushes the policyholder a personalized alert on what to fix. Coalition runs global honeypots and AI to watch attacker behavior in real time, feeding that telemetry back into its risk models. If an incident happens anyway, Active Response kicks in — Coalition’s in-house digital-forensics/incident-response and claims teams manage the event.

Coalition claims this loop measurably reduces losses — that its policyholders see on the order of 70% fewer claims than the broader market because they’re warned before attackers strike. That is a company figure, but the mechanism is genuinely different from legacy underwriting, which prices risk once and then hopes.

Product and business overview

The core product is a cyber-insurance policy, standardized in the US as the Active Cyber Policy since April 2025, available to organizations up to $5 billion in revenue with limits to $15 million — and, via a separate Allianz A+ enterprise product, to $25 million. Around the insurance sit the technology layers: Coalition Control (attack-surface monitoring, offered free as a lead-generation wedge), the Coalition Risk Assessment security rating, and the DFIR/claims response service. It also sells adjacent lines — technology E&O, executive risks, MPL — plus AI-era coverage like a deepfake-response endorsement. The frame Coalition pushes: neither security vendor nor traditional insurer, but a full-stack “risk decision” company monetizing through premium.

Business model and pricing

Coalition makes money three ways, and the mix is the whole investment question. As an MGA it earns commission on premium placed with carrier partners — for a typical MGA, roughly 60-80% commission, 20-30% profit-share contingent on the book performing, plus some claims/other fees. But Coalition has deliberately moved beyond pure commission. It stood up a Hawaii captive, Palekana, to retain a share of the premium it writes, and in October 2022 launched Ferian Re, a Bermuda cyber reinsurer capitalized with ~$300 million led by BDT Capital Partners, to take on tail risk and profit from its own underwriting. It is also licensed as an admitted insurer (CIC) in all 50 states.

That layering matters. A pure MGA is asset-light with capped downside — bad underwriting mostly hurts the carrier, and the MGA keeps its fee. By retaining risk through Palekana and Ferian, Coalition captures more upside when its loss ratios beat the market — and takes real balance-sheet damage if they don’t. Pricing is bespoke and broker-placed — no public rate card — with premiums scaling to revenue, limits and the scan-derived risk score. The backdrop: US standalone cyber loss ratios ran ~41.6% in 2023 and ~48.8% in 2024 (NAIC/industry), profitable years — but cyber’s danger is not the average year, it’s the correlated tail.

Traction over time

The premium growth is real — roughly half a billion to approaching a billion in about two years, plus the #1 cyber-writer position in North America. Two caveats. First, “premium” is not revenue: as an MGA Coalition books only commission plus profit-share, so these top-line-sounding figures overstate what it earns. Second, the “160,000 customers” (2022) figure blends free Coalition Control users with paying policyholders; the paying base (~110,000 in 2025) is what matters, and its growth (~91,000 to ~110,000) is healthy but far slower than premium implies.

Market analysis

Cyber insurance is a small, fast-growing, structurally under-penetrated line. Coalition and Munich Re both peg global gross written premium at roughly $15-18 billion in 2025, with the US around 60% of it. Forecasters cluster around 14-15% CAGR — MarketsandMarkets sees ~$16.5B (2025) reaching ~$32.2B by 2030; Munich Re projects ~$28B by 2030. The tailwind is obvious — ransomware, business email compromise and funds-transfer fraud keep rising, and boards increasingly treat cover as mandatory. The structural catch is equally real: cyber losses are correlated in a way fire and auto are not. A single widely used software vulnerability, cloud outage, or supply-chain compromise can trigger claims across an entire book at once. That aggregation risk is why reinsurers stay cautious and why building a cyber balance sheet (Ferian) is a bolder bet than it looks.

Competitive intel

The category has four fronts. At-Bay is the twin — insurance-plus-security, broker-distributed, Munich Re capacity — the head-to-head mid-market rival, differentiating on managed detection and response. Cowbell owns the SMB micro-risk end with Zurich behind it, the segment Coalition started in before moving upmarket. Corvus, the original scanning-driven underwriter, was bought by Travelers in 2024 for ~$435 million — the clearest signal incumbents want the tech-plus-permanent-capital combination Coalition is assembling. Resilience competes for enterprise on cyber-risk quantification. Behind all sit the balance sheets — Beazley, Chubb, AXA XL — that out-scale Coalition on capital. Coalition’s answer is not to outgun incumbent capital but to become the underwriting brain they rent — the Allianz deal made concrete. The risk is symmetric: if carriers conclude they can rebuild the scanning stack in-house (Travelers/Corvus suggests they’ll try), Coalition’s leverage erodes.

History and evolution

• Dec 2017 — Spun out of Redacted; debuts with ~$10M (Vy Ventures, Ribbit, Valor).
• 2019-2020 — Series B (~$25M) and a $90M Series C (May 2020) at $890M led by Valor; Swiss Re, Arch and Lloyd’s capacity behind the book.
• Mar 2021 — $175M Series D; scales premium and headcount hard through the pandemic ransomware surge.
• Sep 2021 — $205M Series E at $3.5B+ (Durable Capital, T. Rowe Price, Whale Rock). Announces Palekana captive to start retaining risk.
• Jul 2022 — $250M Series F at $5B (Allianz X, Valor, Kinetic) — peak-market mark; no priced round has topped it since.
• Oct 2022 — Launches Ferian Re, a ~$300M Bermuda cyber reinsurer with BDT Capital Partners — moving from fee-earner to risk-taker.
• Late 2023-2024 — Disbands an inside-sales team; employees describe restructuring and layoffs (Glassdoor), which Coalition framed as targeted cuts, not company-wide layoffs. Premium keeps growing.
• Apr 2025 — Standardizes the US book on the Active Cyber Policy; launches an Allianz A+ enterprise product (limits to $25M) and AI-threat coverage.
• May 2026 — The landmark: Allianz Commercial transitions its entire global standalone cyber portfolio to Coalition as exclusive global cyber partner. Coalition takes over pricing, product, mitigation and claims, backed by Allianz capacity over a minimum 10-year framework; Allianz takes increased equity, a board seat, and commits further investment.

What people say

The case for. Sentiment skews positive on the thing that matters most in insurance — claims. Reviewers cite how fast Coalition mobilizes its in-house incident-response team and how much money that speed recovers; brokers report among the fastest turnaround times of any cyber carrier, and some place cyber exclusively with it. The scanning-and-alert loop is a real differentiator legacy carriers can’t replicate, and the Allianz portfolio transfer is strong third-party validation: one of the world’s largest insurers chose to run its cyber book on Coalition’s engine rather than its own.

The complaints. Three honest negatives. First, employees: Glassdoor sits around 3.9/5 (186 reviews, ~72% recommend) but the qualitative reviews run harsher — micromanagement, “mean girls running some departments,” operational inefficiency, limited advancement, “people leaving in droves,” plus multiple restructuring/layoff episodes in 2023-2024 that Coalition downplayed publicly. Second, valuation staleness: the $5B mark is a July-2022 number from the top of the insurtech bubble, unconfirmed by any priced round since; peers like Corvus sold to Travelers for a fraction of comparable hype, so treat the mark as aspirational until a clean round reprices it. Third — the deepest — the balance-sheet bet. By retaining risk through Palekana and Ferian and now absorbing Allianz’s book, Coalition has turned itself from an asset-light fee-earner into a cyber risk-taker. That works beautifully in benign loss years, but is untested through a genuine cyber-catastrophe year — the exact scenario reinsurers are most nervous about.

Outlook: the open question

Coalition is the best expression of a genuinely good idea — underwrite cyber risk the way a security company would, with continuous telemetry rather than a once-a-year form. The traction is real — largest North American cyber writer, ~$630M premium in 2023, an incumbent handing over its global book — and Motta is a credible operator for this problem. Coalition works as a venture and strategic outcome if active insurance produces structurally, durably lower loss ratios than legacy underwriting at scale — enough that carriers keep renting its engine (Allianz first, others following Travelers/Corvus), its retained balance sheet compounds underwriting profit rather than absorbing it, and its commission-plus-risk economics justify a mark well above the 2022 print. It stalls if two things prove true at once: carriers rebuild the scanning stack in-house and reclaim the underwriting margin, and Coalition’s owned risk (Palekana, Ferian, the transferred Allianz portfolio) meets the correlated tail event cyber insurance has never fully priced — a single cloud, identity-provider, or software-supply-chain failure that turns thousands of independent policies into one claim. The Allianz deal is the fulcrum: simultaneously the strongest validation of the model and the moment Coalition took on enough concentrated cyber risk that a bad year would land on its own books. The open question is not whether Coalition can grow — it clearly can — but whether “active insurance” is a real, defensible reduction in loss ratio or a well-marketed distribution advantage a catastrophe year would expose.

How a challenger would attack it

Exploit the pivot from fee-earner to risk-taker. Coalition’s original edge — asset-light MGA economics with a scanning engine no carrier had — is gone on both ends: Travelers bought Corvus for ~$435M and now runs scanning-driven underwriting on a top-five balance sheet, while Coalition itself has loaded correlated cyber risk onto Palekana, Ferian Re, and the absorbed Allianz book. A challenger stays pure: a next-generation underwriting engine — built on the telemetry sources Coalition doesn’t own, like EDR, cloud-posture, and identity-provider data rather than outside-in port scans — sold as the rented brain to every carrier that isn’t Allianz. Outside-in attack-surface scanning is 2017 technology; the differentiated loss signal in 2026 is inside-out, and At-Bay’s MDR bundling points the direction. The commercial wedge is Coalition’s exclusivity problem: by marrying Allianz, Coalition made itself structurally awkward for Chubb, Beazley, and AXA XL to partner with, leaving a whole tier of incumbent capacity shopping for a neutral engine. And the patient version of the attack simply waits: a single cloud or supply-chain catastrophe year that lands on Coalition’s retained balance sheet — the tail its whole structure is now exposed to — while the pure-fee challenger keeps its commission and its solvency.

Same playbook, new buyer

Active insurance — continuous telemetry pricing a policy that funds prevention and response — is a template, and cyber is only its first application. The nearest port is the AI-risk category Coalition itself is edging toward with deepfake endorsements: standalone coverage for AI agent failures, model errors, and automated-decision liability, underwritten from observability data, with no incumbent book to defend. Second, take the model downmarket and embedded: Cowbell showed the sub-SMB tier responds to adaptive underwriting, but nobody has made cyber a checkbox inside the platforms micro-businesses already use — vertical SaaS, payroll, MSP tooling — where distribution costs collapse and Coalition’s broker-first, upmarket motion doesn’t reach. Third, geography: the US is ~60% of global cyber premium and where all four scanning-native players fight; continental Europe and Asia have rising mandates, incumbent carriers with no scanning stack, and — with Allianz now committed to Coalition — rivals like AXA, Zurich, and Tokio Marine strongly motivated to back a local alternative rather than feed their competitor’s partner. Coalition can’t chase all of this: the Allianz integration, a 10-year framework, will consume its enterprise capacity for years.

Sources and further reading

• How Two Former Spies Cracked The $11 Billion Cyber Insurance Market (Forbes, Feb 2024)
• Coalition Closes $250 Million in Series F Funding, Valuing the Provider at $5 Billion (Coalition, Jul 2022)
• Cyber insurance firm Coalition lands $205M at Series E, valued at $3.5B (TechCrunch, Sep 2021)
• Allianz Commercial Transitions its Standalone Cyber Business to MGA Coalition (Insurance Journal, May 2026)
• Coalition and BDT Capital Partners Launch Ferian Re (Artemis.bm, Oct 2022)
• Coalition’s Motta predicts cyber MGA shakeout (The Insurer, May 2026)
• Cyber insurance business Coalition cuts sales team (Insurance Business, Jan 2024)
• Coalition Reviews — employee ratings (Glassdoor, accessed 2026)
• Cybersecurity Insurance Market worth $32.19 billion by 2030 (MarketsandMarkets, 2025)
• Coalition, At-Bay, Cowbell, Corvus, Beazley: cyber carrier comparison (Seedpod Cyber, 2026)