Resilience

Snapshot

Resilience is a cyber-insurance MGA and managed security provider that sells mid-market and enterprise cyber policies, bundles them with ongoing risk-reduction services, and keeps a chunk of the underwriting risk in its own Bermuda reinsurance captive. Its customers hand over an attack-surface scan, Resilience prices the policy on a loss model that updates with the client's actual security posture, and the client gets both a coverage line and an outsourced security team on retainer. It has raised more than $320 million including a $100 million Series D announced in October 2026 led by Intact Ventures and Lightspeed. It matters now because the hard cyber market that drove triple-digit renewal increases in 2022 has softened, carriers are leaving mid-market cyber after the 2024 and 2025 claims cohorts, and the thesis that an underwriting-and-services bundle is structurally better than pure carrier underwriting is being pressure-tested for the first time.

Founding story

Resilience was founded in 2016 by Vishaal "V8" Hariprasad (CEO), Raj Shah (chairman), Mario Vitale (then president, now retired), and George Ng (CTO). Hariprasad is a former US Air Force cyber officer and a founder of previous security-data startup Morta Security (acquired by Palo Alto Networks in 2014). Shah is a former Pentagon advisor who led the Defense Innovation Unit. The founding team's thesis was explicit: cyber insurance, as practiced in 2016 by Lloyd's syndicates and US property carriers, was underwriting blind, ignoring technical posture and pricing off demographics. A team with security and defense pedigree could underwrite from the technical data itself, and if the model worked, keep the underwriting profit by reinsuring via its own captive instead of ceding it all to a carrier. The company's prior identity was "Arceo.ai"; a 2020 rebrand to Resilience coincided with the pivot from pure security analytics to integrated carrier.

How it works

A Resilience engagement begins with an attack-surface scan plus a questionnaire-based assessment that scores the client against Resilience's internal risk model. The risk model is a Bayesian aggregation of external scan findings, controls data (MFA, EDR, backup segmentation), historical incident data, and industry exposure. The output is a policy with named, dollarised sub-limits for ransomware, business email compromise, dependent business interruption, and privacy. After bind, the client is onboarded to the Resilience platform: a customer-success team runs quarterly risk reviews, alerts on scan regressions, and coordinates with the client's SOC. Claims are handled by an in-house incident response team (acquired via the 2021 acquisition of Kovrr-adjacent incident firms) with a panel of outside law firms. On the capital side, Resilience underwrites on paper from third-party carriers (initially Tokio Marine Kiln and Intact; today a broader panel) and retains a portion of each risk through its own Bermuda-based reinsurance captive. Both sides of the ledger — underwriting P&L and services ARR — feed a unit economics model the company has been iterating since 2020.

Product and business overview

The portfolio has three products: Cyber primary, the core policy that bundles loss coverage with the platform access; Cyber excess, written on the same risk after a first-dollar carrier; and Managed Cyber Risk Solutions, a wider platform with security health checks, tabletop exercises, and ransomware-response retainers that non-policyholders can also buy. The target customer has shifted meaningfully. Initially SMB, Resilience pushed up-market from 2022 and in January 2024 announced it could underwrite customers with up to $10 billion in annual revenue (per Reinsurance News, Jan 2024). The practical sweet spot is mid-market to lower-large: companies in the $500M–$5B revenue band, where the client has a CISO but not a dedicated cyber risk-transfer team.

Business model and pricing

Revenue flows through three streams. Premiums collected on policies where Resilience is the MGA, with a commission override to Resilience and underwriting P&L shared with its reinsurance captive. Services fees paid by policyholders for the managed-cyber-risk platform. And a small reinsurance-brokered line where Resilience fronts for other MGAs. Mid-market cyber premiums as of late 2024 ran roughly $8,000–$75,000 per million dollars of coverage, depending on industry and controls; Resilience targets accounts with $10,000–$500,000 annual premium. The underwriting pitch to carriers is that the services bundle reduces loss cost 20–40%; the pitch to customers is that the services pay for the premium.

Traction over time

Date	Milestone
2016	Founded as Arceo.ai in San Francisco.
2020 May	Rebranded to Resilience after $35M Series B.
2021 Nov	$80M Series C led by General Catalyst at $800M+ post-money.
2023 Aug	$100M Series D announced (first version, General Catalyst-led).
2024 Jan	Extends underwriting authority to clients up to $10B revenue.
2024 Apr	Expands cyber coverage limits to $10M per policy.
2025	Named MGA of the Year at Cyber Insurance Awards Europe.
2026 Oct	$100M Series D (new tranche) led by Intact Ventures and Lightspeed.

Resilience has stated active policyholders at 500+ enterprises as of 2024 and premiums placed exceeding $750M cumulative. Headcount sits near 400 per LinkedIn (late 2026).

Market analysis

Standalone cyber insurance premiums written globally reached roughly $17–20 billion in 2024 and are forecast to double by 2030, per S&P Global and Munich Re outlooks. Within that, the US and UK mid-market cyber segment (companies $100M–$5B revenue) is the fastest-growing slice and the one carrier capacity has been most reluctant to deepen since the 2021–2022 ransomware wave. The structural tailwind is that every company's cyber risk compounds with their software stack; the headwind is that pure-cyber carriers have had three brutal cohorts (2019–2021) and underwriting discipline has tightened. Rates softened materially through 2024 and 2025, pressuring MGAs like Resilience that need volume to amortise the services platform.

Competitive intel

Coalition (San Francisco, ~$770M raised, valued at ~$5B in 2022) is the largest and most direct competitor: same MGA-plus-security bundle, broader SMB tilt, aggressive growth, and now extending up-market to meet Resilience in the mid-market. At-Bay (Palo Alto, ~$300M raised) runs a similar model with tighter SME focus and a loss ratio consistently reported below 40%. Corvus (acquired by Travelers in January 2024 for $435 million) is the cautionary tale — a close Resilience peer that sold once the underwriting cycle turned. Cowbell Cyber targets SMB and has more conservative capital. Chubb, AIG, Beazley, and Travelers itself are the traditional carrier incumbents; they write bigger limits but without the active-services bundle. Kettle (parametric) and Parametrix target the dependent-business-interruption sub-line. The active debate in reinsurance circles is whether the MGA bundle beats the traditional carrier model at scale, or whether as rates fall and claims normalise, traditional carriers with lower cost structures recapture premium.

History and evolution

Four phases. 2016–2019 as Arceo was a security analytics company with an insurance-adjacent go-to-market — the model was data-first, insurance was the natural exit. The 2020 rebrand to Resilience and the $35M round reflected a decision to become a carrier rather than sell to one. 2021–2022 was ransomware's peak and Resilience's growth-fuel moment; the company scaled policies written 5x over 18 months and earned the right to launch its Bermuda captive. 2023–2024 was consolidation: Corvus sold to Travelers, carrier capacity quietly exited mid-market cyber, and Resilience moved up-market to defend premium per account. 2025–2026 is the current test: softening rates, concentration risk (if a single large customer suffers a loss, the Bermuda captive wears disproportionate exposure), and the Series D that resets runway. The Intact Ventures lead on the Series D is strategically important — Intact is a major Canadian insurer and brings paper as well as capital, pointing to a deeper carrier relationship.

What people say

The case for. Brokers (Marsh, Aon, Lockton) on trade press panels consistently praise Resilience for underwriting transparency and for the data the services bundle feeds back to clients. Several brokers quoted in Insurance Business through 2024 said Resilience quotes faster than carrier markets for mid-market risks. Loss-ratio disclosures (self-reported) have remained below the traditional cyber-carrier average, supporting the services-reduce-loss thesis. The Cyber Insurance Awards Europe MGA-of-the-year win (2025) is an industry signal.

The complaints. The most frequent complaint, from brokers and reinsurance analysts, is that Resilience's services pitch — the SOC-on-retainer model — is more marketing than consistent delivery for policyholders outside the top-200 accounts. Mid-sized customers on G2 cite uneven service quality, with security reviews that feel templated. Employee reviews on Glassdoor are mixed: positive on mission, mixed on compensation, with recurring themes of pricing pressure as the market softens. Reinsurance-industry commentators have raised concentration-risk questions about the Bermuda captive — a single systemic ransomware event could destabilise it faster than a diversified property-cat book. Finally, the claim that services reduce loss ratio 20–40% remains difficult to audit externally; carriers on Resilience's panel have the true data.

Outlook: the open question

Does the bundled MGA-plus-services model earn a durable underwriting premium over traditional carriers once the cyber market fully re-opens to capacity and rates normalise? For yes: Resilience needs to show a sustained combined ratio of 85–90% across 2026–2028, while at least one systemic cyber event (a major cloud or SaaS outage, or an industry-wide ransomware wave) validates that services-bundled accounts actually produce fewer or smaller losses. The Series D paper from Intact should pay in a deeper fronting-carrier relationship. For no: rate softening forces Resilience to accept thinner commissions, the Bermuda captive shows volatility at the first large loss event, services operations scale faster than operating leverage can produce, and the company becomes an acquisition target at a flat-to-down valuation — the Corvus outcome.

How to attack it

A new entrant should attack by de-bundling. Resilience sells a single bundle of insurance plus services; an attacker could compete on either side alone. On the insurance side, a lean MGA with rigorously priced technical underwriting but no services overhead could undercut Resilience by 10–15 percentage points on commission while leaving the SOC-on-retainer play to specialist managed-security vendors. On the services side, a pure cyber risk-management platform (a Vanta or Drata for insurance) could sell to Resilience's own policyholders as a cheaper and more consistent alternative to Resilience's internal services team. The biggest exploitable weaknesses are three: first, the Bermuda captive concentration-risk problem — carriers who can lay off risk across a diversified book have structural capital-cost advantage; second, the services-delivery uneven-quality issue in the mid-market tier that is Resilience's core customer base; third, Resilience's heavy dependence on broker channel economics that are being compressed industry-wide, and that leave the company vulnerable to a direct-to-cyber-CISO distribution model a pure digital insurer could pursue. A wedge model: a mid-market cyber MGA that uses large language models for underwriting data ingestion (speeding submissions from days to minutes), prices off real-time attack-surface deltas, and ships policyholders a lightweight dashboard without building its own SOC. That play sits precisely where Resilience is fully built and defensively priced.

Adjacent-segment play

The underlying capability — technical-risk-model underwriting bound to active services — generalises further than Resilience has pursued. Vendor and third-party cyber risk is the biggest adjacency: carriers today underwrite the policyholder but not the policyholder's SaaS suppliers; a Resilience-style product that insures against third-party breach losses (an upstream policy for the client's vendor stack) is a logical extension. BitSight and SecurityScorecard have the data but not the insurance mechanism. Cyber-adjacent operational insurance — DeFi protocol coverage, AI-model-risk coverage — uses the same underwriting discipline on new attack surfaces; Chainalysis-adjacent crypto cyber players (Nayms, Evertas) already exist in small forms. Non-cyber technical-risk insurance — insurable AI hallucination losses, cloud SLA breach coverage — is adjacent but requires a different claims apparatus. The capability does not generalise obviously to commercial auto, workers' comp, or property-cat; those are physical-world risk books with legacy loss-development patterns that technical attack-surface data cannot illuminate. The clear adjacent wedge is third-party cyber — same data, same claims surface, different coverage trigger, and no incumbent has owned it.

Sources and further reading

• Resilience raises $100M in Series D funding round — Reinsurance News, October 2026
• Resilience raises $100m Series D — Tech Outlook, October 2026
• Resilience extends underwriting authority to clients with up to $10bn revenue — Fintech Global, January 2024
• Cyber insurance firm Resilience raises $80M — VentureBeat, 2021
• Resilience nabs $100M to combine cyberinsurance and breach-prevention services — SiliconANGLE, August 2023
• Resilience wins Cyber Insurance Awards Europe for MGA of the Year — Cyberresilience newsroom, 2025
• Cyber Insurance Statistics 2026 — Medha Cloud
• Cyber Risk Investments to Shape 2026 Insurance Market — Insurance Business, 2026