Resilience

Resilience is testing whether a cyber MGA can turn security operations into an underwriting advantage rather than an ancillary service. Its proposition joins delegated insurance, in-house claims, a 24-hour Risk Operations Center and software that expresses cyber exposure in financial terms. That integration can create a useful feedback loop: observed vulnerabilities inform risk selection, claims reveal which controls matter and post-bind monitoring can reduce loss between annual underwriting snapshots. It also creates governance questions that are easy to overlook. Clients need to know which software findings affect eligibility, pricing or coverage; whether risk scores can be challenged; how rapidly new threat intelligence changes underwriting treatment; and whether the same evidence is shared consistently with capacity partners. Resilience reports that more than 10% of U.S. enterprises with over $1 billion in revenue use its integrated solutions, while its U.S. limit capability reaches $20 million through rated and Lloyd’s capacity. Those figures demonstrate reach but do not substitute for transparent portfolio performance. The company’s 2026 claims analysis is more revealing: phishing, social engineering and transfer fraud were associated with 85.3% of incurred loss, and ransomware produced 73% despite representing 5.8% of claims. The asymmetry supports continuous controls and rapid containment, but results from Resilience’s own book should not be treated as a market-wide benchmark without knowing exposure mix, limits, attachment points and claim maturity. Arc, launched for multi-entity organizations, extends the model from individual insureds to corporate portfolios and private-equity holdings. It may improve visibility across acquisitions and shared systems, yet it can also encourage false precision if entity-level data quality is uneven. The measures that matter are loss ratio and severity by underwriting cohort, security-intervention adoption, capacity renewal and concentration, rate and attachment adequacy, risk-score overrides, claims response times, broker retention and whether prevented-loss claims are supported by a reproducible counterfactual. Resilience’s strongest strategic asset is not simply technology; it is the ability to connect operational evidence to insured financial outcomes without allowing commercial incentives to distort either.