At-Bay

At-Bay is built around a proposition that challenges the annual-cycle logic of traditional insurance: cyber risk changes too quickly to be evaluated only at application and renewal. The company combines delegated underwriting with continuous external scanning, security advice, managed detection and response, fraud defense, incident recovery and claims data. In principle, that gives the insurer a feedback loop from pre-bind technology signals to post-bind interventions and loss outcomes. In practice, it also requires unusually clear governance because the same platform can observe a customer’s vulnerabilities, influence security decisions, price the insurance and participate in claims handling.

The current insurance portfolio spans E&S cyber, technology errors and omissions and miscellaneous professional liability. At-Bay offers primary and excess cyber and Tech E&O for businesses with revenue up to $5 billion and limits up to $10 million, while its MPL product provides primary limits up to $5 million. Smaller in-appetite risks can receive automated quotes through the broker platform or API; larger or more complex accounts move to underwriter review. The division of labor matters. Automation should handle repeatable eligibility and pricing, not conceal judgment. Quote speed needs to be evaluated with referral quality, data completeness, policy accuracy, endorsement activity and subsequent loss performance.

At-Bay Stance is the connective layer between insurance and security. Policyholders with the relevant embedded-security endorsement receive access to exposure management, advisory services, awareness training and fraud-defense capabilities; managed detection and response is available separately. At-Bay says roughly one in three cyber policyholders actively uses Stance. That adoption figure is strategically more important than access alone. A security service embedded in a policy changes loss only when the customer activates it, remediates findings and keeps it configured. The useful measures are activation, time to remediation, control persistence and loss frequency and severity for comparable adopters and non-adopters.

The company’s 2026 InsurSec report draws on more than 100,000 policy-years of claims and exposure data. It reported a 26% increase in average claim severity during 2025 for companies below $25 million in revenue and a 70% increase in third-party liability claim frequency. Those are At-Bay portfolio findings, not universal market statistics. They are still valuable because they link losses to observed technology environments. The methodological questions are exposure mix, policy terms, limits, claims maturity, customer growth and whether security scans reflect conditions before or after an incident. A carrier or broker should distinguish causal evidence from correlation before converting a report finding into an underwriting rule.

Integrated security creates a potential alignment advantage. Preventing incidents can benefit insureds and risk-bearing capital providers, while supporting the durability of At-Bay’s underwriting relationships. Integration alone does not establish that incentives are better aligned than those of a standalone security provider. Yet insurance incentives can create their own conflicts. If a scan identifies a severe vulnerability after bind, the insured needs to know whether the information changes coverage, renewal, pricing or claims treatment; the capacity provider needs to know whether the MGU acted; and regulators may care whether similarly situated businesses were treated consistently. Product disclosures state that Stance is not a substitute for a comprehensive security program and that participation in separate MDR services is not required for coverage. The current cyber product page further states that similar credits and enhancements are available for comparable solutions. Its separate MDR service is provided by At-Bay Security, LLC and is also available to non-policyholders. Coverage enhancements depend on the business’s risk profile and qualifying conditions, so advertised retention reductions or fraud sublimits are not unconditional benefits. MGA Index analysis: brokers should separate the choice of security provider from eligibility for an insurance enhancement, confirming which controls and evidence qualify before a customer changes providers. These boundaries should remain visible as integration deepens.

The August 2026 agreement for Munich Re to acquire At-Bay is the most important current strategic development. Munich Re announced a $575 million enterprise value and expects closing in the first quarter of 2027, subject to regulatory approval and other conditions. At-Bay would be overseen by HSB, Munich Re’s technology-focused specialty business and a strategic partner since the company’s early years. Munich Re reported $278 million of At-Bay cyber gross written premium and $23 million of cyber fee-service revenue for 2025, approximately 280 employees and close to 40,000 protected U.S. businesses. Until the transaction closes, it remains pending and the companies continue under their existing ownership and contractual structures.

The proposed combination could tighten the link among underwriting, security, claims and risk-bearing capital. HSB brings rated insurance paper, engineering heritage and Munich Re’s cyber and reinsurance resources; At-Bay brings SME distribution, security telemetry and a modern underwriting workflow. The opportunity is to turn a long-standing capacity relationship into faster product and control development. The risk is reduced independence. A multi-carrier MGA can compare capacity sources and preserve optionality; a carrier-owned platform may face pressure to prioritize affiliated paper, share sensitive data across a broader group or align appetite with parent portfolio needs. Brokers and existing capital partners will watch how carrier choice, commission, claims authority and data permissions change after closing.

At-Bay has also owned a Delaware-domiciled E&S carrier since 2023, acquired from AXA XL and licensed in 44 states at announcement. Ownership of paper can reduce dependence on third parties and give the company more control over forms and filing strategy, but it changes capital and governance requirements. The group still describes At-Bay Insurance Services as a licensed agency and surplus-lines broker offering policies underwritten by non-admitted insurers. Each quote should identify the issuing carrier; the existence of an affiliated carrier does not mean every policy sits on the same balance sheet.

Claims and response are integral to the product thesis. Cyber loss is highly time-sensitive: funds may be recoverable only if fraud is escalated quickly, ransomware containment can limit business interruption and forensic evidence can affect coverage and litigation. At-Bay’s 2026 report said businesses notifying it within three days recovered at least some transferred funds 70% of the time. The statistic is company-reported and selection-sensitive, but it supports a practical control objective: reporting pathways, pre-authorized vendors and incident exercises should be established before loss. Claims integration should be measured by notification lag, containment time, recovery rate, business-interruption duration, reserve development and customer outcomes—not marketing testimonials.

At-Bay’s long-term value depends on whether it can prove that security changes underwriting economics, not simply that customers use the tools. The measures worth watching are gross written premium and fee revenue by product; primary versus excess mix; limits and attachments; carrier and reinsurance concentration; automated versus referred submissions; quote-to-bind and renewal retention; rate and exposure change; vulnerability and control signals used in pricing; Stance activation and remediation; false-positive and override rates; ransomware, fraud and liability frequency and severity; incident-notification and containment time; funds recovery; reserve development; claims expenses; security-service margin; affiliated-carrier utilization; data-consent and complaint metrics; broker concentration; capacity renewal; and any post-acquisition changes in paper, authority or information sharing.