At-Bay

1.1 Corporate Identity, Mission, and Operating Model

At-Bay, Inc. was established in 2016 as a specialized cyber insurance and risk management technology company designed to address the structural protection deficit facing small and medium-sized enterprises in the United States. Rather than operating purely as a conventional managing general agent (MGA) that assesses static risk questionnaires annually, At-Bay pioneered an integrated InsurSec architecture that couples primary cyber liability coverage with continuous active threat monitoring and automated vulnerability detection. The company's commercial model centers on distributing policies through wholesale and retail insurance brokers while equipping policyholders with proprietary security telemetry and incident response capabilities via At-Bay Stance. Headquartered in San Francisco with specialized engineering operations anchored in Tel Aviv, At-Bay has scaled its insured footprint to more than 40,000 active policyholders safeguarding tens of billions in aggregate commercial revenue across diverse commercial sectors.[CO001, CO002, CO009, CO011]

1.2 Founders, Executive Leadership, and Governance

The company was co-founded by Chief Executive Officer Rotem Iram and Chief Risk Officer Roman Itskovich, alongside cybersecurity architects Etai Hochman and Tilly Kalisky. Iram's operational background spans elite technological intelligence service and management consulting, providing strategic vision around closing the SME cybersecurity exposure gap. Itskovich drives actuarial modeling, pricing algorithms, and portfolio risk management, which form the quantitative bedrock of At-Bay's loss ratio performance. Corporate governance historically incorporated representatives from tier-one venture capital firms, while strategic reinsurance leadership was maintained through close executive alignment with Munich Re and Hartford Steam Boiler (HSB). Following the execution of the definitive acquisition agreement, At-Bay's executive leadership and core workforce of approximately 280 employees will transition into an autonomous business unit within HSB, ensuring leadership continuity while transferring institutional risk oversight to Munich Re Specialty.[CO001, CO002, CO010, CO012]

1.3 Financing History and Munich Re Acquisition

Between its founding in 2016 and late 2021, At-Bay raised approximately $292 million to $296 million in equity capital across institutional venture financing rounds led by prominent investors including Lightspeed Venture Partners, Khosla Ventures, Microsoft's M12, Qumra Capital, and Munich Re Ventures. The company attained unicorn status in July 2021 with a $185 million Series D financing that valued the business at $1.35 billion post-money. On August 19, 2026, Munich Re announced a definitive agreement to acquire At-Bay in an all-cash transaction valuing the enterprise at $575 million. While the transaction represents a successful liquidity event that returned capital to early shareholders and employees, the 57% markdown against peak venture pricing reflects the severe recalibration of private-market tech multiples following the zero-interest-rate era. The acquisition also followed targeted corporate restructurings, including Israeli R&D workforce layoffs, aimed at optimizing operating cost structures ahead of transaction execution.[CO003, CO004, CO005, CO006, CO010, CO014]

1.4 Corporate Milestones and Strategic Trajectory

At-Bay's operational trajectory illustrates the maturation of the cyber insurtech sector from early capacity-dependent distribution to vertically integrated balance-sheet and software operations. A critical milestone occurred in early 2023 with the acquisition of an admitted excess and surplus lines insurance carrier, allowing At-Bay to write commercial policies directly on its own paper. In April 2023, the launch of At-Bay Stance formalized the company's InsurSec positioning by packaging automated endpoint vulnerability scanning, threat advisory, and Managed Detection and Response (MDR) as standard policyholder benefits. By year-end 2025, At-Bay generated $278 million in gross written premiums and $23 million in recurring cybersecurity fee service revenue. The pending acquisition by Munich Re, slated for regulatory closing in early 2027, culminates a decade of partnership by embedding At-Bay's software-driven underwriting engine directly into global balance-sheet reinsurance infrastructure.[CO001, CO003, CO007, CO008, CO011, CO012, CO013]

1.5 Exhibits

2.1 Market Boundary, Category Scope, and Adjacencies

The cyber insurance market has undergone a structural transition from discretionary commercial coverage to an essential operational risk transfer and security compliance instrument. Modern market scope encompasses primary cyber liability and errors and omissions coverage combined with active attack surface monitoring and incident response services, a convergence termed InsurSec. Included spending covers gross written premiums for first-party data recovery, business interruption, extortion reimbursement, third-party liability defense, and integrated security telemetry. Excluded adjacent spending comprises standalone enterprise SIEM architectures, broad endpoint management suites, and general commercial property policies that lack explicit cyber affirmative coverage. At-Bay operates within this perimeter as an insurance agency and surplus lines broker across all fifty states, distributing surplus lines policies backed by non-admitted carrier capital while deploying proprietary exposure management software.[CM001, CM003, CM005, CM011]

2.2 TAM, SAM, and Sizing Estimates Across Industry Lenses

Sizing the cyber risk opportunity requires triangulating conservative insurer premium figures against aggressive InsurSec projections that aggregate security software and risk transfer budgets. On a primary risk transfer basis, global gross written cyber premiums are benchmarked at $16.4 billion in 2026 according to Swiss Re figures, with broader analyst bounds reaching $23.3 billion per Mordor Intelligence. Market growth experienced rate stabilization in 2025, where global premiums tracked by Munich Re slightly compressed from $15.3 billion in 2024 to approximately $15.0 billion due to softer market pricing despite rising claims volume. Conversely, At-Bay defines a wider addressable InsurSec market projected to reach $80.0 billion by 2028 with a 22.0% compound annual growth rate by bundling insurance with managed detection, vulnerability management, and incident response. The serviceable addressable market centers on small and mid-market businesses, where median annual premiums sit near $1,740 for small firms and scale into low-six figures for mid-market accounts.[CM001, CM002, CM003, CM010]

2.3 Buyer Segmentation, Budget Ownership, and Purchase Workflows

Customer segmentation in cyber insurance spans three distinct tiers with divergent procurement workflows, technical capacity, and budget owners. Small businesses with fewer than 250 employees represent the bulk of policy volume, with historical claims data demonstrating that 98% of claims arise from organizations with annual revenue under $2 billion. In small firms lacking dedicated security personnel, policy purchases are driven by business owners or financial controllers seeking contractual compliance, transacted through retail insurance brokers. Mid-market enterprises generating between $50 million and $500 million divide authority between corporate risk managers and IT directors, evaluating policies on extortion sublimits and managed threat containment speed. Upper mid-market buyers with revenue up to $5 billion require specialized fraud and ransomware packages with automatic flat renewals, where treasury and risk executives control commercial insurance budget lines while security teams validate endpoint telemetry integrations.[CM004, CM005, CM010, CM011, CM012]

2.4 Growth Drivers, Loss Dynamics, and Underwriting Friction

Market expansion is propelled by acute regulatory disclosure pressures and systemic cyber threat escalation, balanced against stringent underwriting friction. Regulatory rules including the SEC four-day material breach disclosure mandate have compelled organizations to secure insurance policies primarily to access pre-vetted legal counsel and incident response panels on immediate retainer. Concurrently, loss dynamics continue to intensify: in 2024, ransomware claim frequency among small and mid-market companies surged by 20% for the third consecutive year, carrying average incident costs near $470,000, while financial fraud losses averaged $270,000. At-Bay's claims research reveals that remote access services served as the entry vector in 87% of ransomware incidents, with average claim severity reaching $508,000. These loss pressures force underwriters to mandate non-negotiable baseline security hygiene, specifically multi-factor authentication, monitored endpoint detection, and immutable air-gapped backups, creating friction that limits under-defended organizations from obtaining affordable coverage.[CM006, CM007, CM008, CM009, CM013, CM014]

2.5 Exhibits

3.1 Competitive Landscape: InsurSec Peers, Legacy Insurers, and Security Substitutes

The cyber insurance and risk management market is characterized by a structural divide between traditional property and casualty insurers and modern technology-driven managing general agents (MGAs). At-Bay operates in the specialized InsurSec category, which directly merges commercial cyber insurance underwriting with active technical threat prevention. Within this domain, At-Bay primarily contests accounts against Coalition, Cowbell, and Resilience. None of these specialized MGAs publish flat rate cards, forcing commercial buyers to negotiate coverage through licensed insurance brokers based on bespoke digital risk profiles. Coalition represents At-Bay's closest direct peer in scale and technical scope, marketing an Active Insurance model that pairs automated scanning with Wirespeed MDR and the broader Coalition Control platform. Coalition achieved a $5B valuation following a $250M Series F in 2022 and maintains the widest product lineup in the peer group, spanning cyber, executive risks, and emerging AI threats across a multi-carrier capacity panel. Cowbell targets the smaller end of the enterprise spectrum, emphasizing adaptive continuous underwriting driven by Cowbell Factors and backed by a $60M Series C led strategically by Zurich in 2024. Resilience approaches the market from the upper-middle-market and enterprise tier, utilizing its proprietary Threatonomics Risk Graph to translate technical security telemetry into dollar-quantified balance sheet exposure. In contrast, incumbent multi-line carriers such as Chubb and Travelers command dominant market share and formidable balance sheets, yet continue to rely on annual static underwriting questionnaires and third-party vendor panels rather than embedded active monitoring.[CP001, CP002, CP003, CP004, CP006, CP007, CP013]

3.2 Capability and Architectural Differentiation: Bundled InsurSec vs. Point Solutions

At-Bay's primary product differentiation centers on its proprietary InsurSec architecture, anchored by At-Bay Stance. Launched in April 2023, At-Bay Stance unifies automated vulnerability scanning, dark web credential monitoring, AI-driven email fraud alerts, virtual CISO advisory, and incident response into an end-to-end risk management workflow. At-Bay claims these embedded risk mitigation capabilities represent up to $70,000 in annual value per policy, directly addressing the acute cybersecurity talent and tooling shortage facing small and mid-sized enterprises. Furthermore, At-Bay operates an in-house Digital Forensics and Incident Response (DFIR) unit, contrasting with legacy insurers that outsource breach triage to fragmented third-party panels. However, product scope comparisons reveal nuanced operational tradeoffs. While basic vulnerability scanning is embedded into all core policies, At-Bay's managed detection and response (MDR) services for endpoints and email are structured as optional add-ons that carry incremental subscription costs. Forbes reported that At-Bay's MDR customer count expanded from under 1,000 clients in 2023 to 7,500 by year-end 2024, demonstrating strong commercial momentum but confirming that MDR is not yet universal across its roughly 40,000 policyholders. By comparison, Coalition provides baseline alerting across all policyholders via Coalition Control while offering Wirespeed MDR for deeper containment. Relative to pure-play cybersecurity vendors like CrowdStrike or SentinelOne, At-Bay offers an integrated financial safety net that software vendors cannot match, but its detection telemetry depth remains tied to partner sensor integrations rather than a proprietary endpoint agent ecosystem.[CP005, CP008, CP009, CP010, CP011, CP013]

3.3 Pricing Opacity, Packaging Architecture, and Broker Distribution Moats

Commercial cyber insurance exhibits significant pricing opacity across all major providers. Neither At-Bay, Coalition, Cowbell, nor Resilience publishes standard pricing tables; premiums are dynamically determined by policy limits, industry hazard class, annual revenue, and automated attack surface scan results. At-Bay packages its coverage across three structured tiers—Core, Advanced, and Complete—bundling routine external scanning and vCISO consultations while gating full-scale 24/7 endpoint MDR behind paid upgrades. To incentivize risk reduction, At-Bay provides premium credits and enhanced terms for policyholders that adopt recommended security controls, aligning buyer incentives with underwriting profitability. Distribution represents a critical competitive battleground and defensibility moat. Unlike consumer insurtechs attempting direct-to-business models, At-Bay relies overwhelmingly on appointed independent retail and wholesale insurance brokers across all 50 states. The company has invested heavily in digital broker enablement, delivering rapid automated quotes and underwriting decisions that have garnered an exceptional 93 Net Promoter Score (NPS) among broker partners. This broker loyalty creates a formidable barrier to entry against pure software vendors and newer insurtech entrants. However, because commercial insurance policies are typically written on standard one-year surplus lines terms, account retention remains subject to annual market shopping, leaving At-Bay vulnerable if competing MGAs offer aggressive pricing or higher broker commission schedules.[CP001, CP010, CP011, CP012, CP014]

3.4 Moat Durability, Capacity Stability, and Strategic Acquisition Dynamics

The long-term durability of At-Bay's competitive moat has been substantially reshaped by Munich Re Group's August 2026 agreement to acquire the company. As an independent MGA, At-Bay historically faced structural capacity exposure: while managing underwriting and security software, it relied on external carrier paper, retaining roughly 15% of net risk while ceding the remainder to reinsurance partners led by Munich Re's Hartford Steam Boiler (HSB). Integrating fully into Munich Re Specialty permanently stabilizes At-Bay's underwriting capacity, backing its policies with an A++ (Superior) balance sheet that eliminates the carrier-flight risk that frequently threatens independent MGAs. Nevertheless, competitive pressures remain acute across multiple vectors. In the upper middle market, Resilience continues to gain ground among CFOs and enterprise risk managers through quantitative financial modeling that appeals to executive buyers. Meanwhile, Coalition's broader product portfolio—encompassing management liability, Tech E&O, and specialized coverage—provides greater multi-line bundling power across commercial brokerages. Furthermore, as legacy carriers gradually modernize their underwriting tech stacks and partner with commercial MSSPs, the technological gap between insurtech MGAs and incumbent giants will narrow. At-Bay's enduring defensibility will depend on whether its combined InsurSec platform can continuously prove superior loss-ratio outperformance, transforming security software from an underwriting feature into an indispensable operational workflow.[CP002, CP004, CP006, CP007, CP012, CP014]

3.5 Exhibits

4.1 Revenue Streams and Pricing Model

At-Bay structures its commercial revenue across two distinct engines: primary and excess cyber insurance premiums and high-margin cybersecurity software service fees. In the 2025 financial year, At-Bay generated $278 million in gross written premiums across its commercial lines, alongside $23 million in cybersecurity fee service revenue. The core insurance offering spans Cyber, Technology Errors and Omissions (Tech E&O), and Miscellaneous Professional Liability (MPL), distributed exclusively through wholesale and retail insurance brokers via At-Bay's automated broker platform. Standalone cyber and Tech E&O policies are dynamically priced based on external vulnerability scans and automated risk models. The cybersecurity software engine is anchored by At-Bay Stance, which bundles continuous exposure management, security awareness, and managed detection and response (MDR). While base exposure management is embedded into primary surplus policies, standalone exposure platforms typically command market list prices exceeding $5,000 annually. Advanced security capabilities, notably At-Bay Stance MDR, are offered across Core, Advanced, and Complete tiers for additional subscription fees. Paid MDR customer adoption accelerated rapidly from fewer than 1,000 accounts in 2023 to 7,500 by year-end 2024, demonstrating that the InsurSec bundling strategy creates a genuine secondary recurring software revenue stream alongside underwriting volume.[CI002, CI003, CI006, CI009, CI010, CI011]

4.2 Broker Distribution Mechanics and Value Conversion

At-Bay's go-to-market motion relies on an indirect, broker-led distribution model rather than direct-to-consumer sales. By providing automated risk assessments, rapid quote turnarounds, and specimen coverage forms through its proprietary broker platform, At-Bay integrates into regional and national brokerage workflows. This distribution footprint enables At-Bay to safeguard up to $800 billion in collective business revenue across nearly 40,000 policyholders in more than 100 industries. When a broker submits an SMB or middle-market risk, At-Bay executes an external security scan that informs dynamic policy pricing and terms. Upon binding, policy premiums convert into gross written premiums, but At-Bay operates as a hybrid managing general underwriter (MGU) and full carrier via At-Bay Specialty Insurance Company. Instead of absorbing the entirety of catastrophe and aggregation risk onto its own balance sheet, At-Bay transfers approximately 85% of insurance risk to established reinsurance and capacity partners, principally Munich Re and Hartford Steam Boiler (HSB), retaining 15% net risk. This structure allows At-Bay to scale premium throughput rapidly with an efficient organizational footprint of approximately 280 employees, while monetizing policyholder relationships through both retained risk margin and high-margin security service add-ons.[CI004, CI006, CI007, CI008, CI013]

4.3 Cost Structure, Risk Retention, and Unit Economics

Evaluating At-Bay's unit economics requires distinguishing between managing general underwriter commissions, carrier risk retention, and software delivery costs. By retaining only 15% of underwritten risk, At-Bay moderates statutory capital reserve requirements and insulates its balance sheet from catastrophic systemic ransomware aggregation. Prior reporting indicated that At-Bay generated more than $110 million in net revenue and $301 million in gross insurance premiums during 2023, while maintaining underwriting loss ratios significantly below legacy peers due to pre-breach vulnerability remediation. However, consolidated GAAP profitability, operating burn rates, and gross margin splits between insurance administration and software engineering remain closely guarded private data. Critical sales efficiency proxies, including cohort-level customer acquisition costs (CAC), broker commission concessions, and net revenue retention (NRR) across SMB cohorts, have not been publicly disclosed. While active risk monitoring helps prevent loss frequency, service delivery costs for dedicated managed detection and response (MDR) teams represent an ongoing operational expenditure that differs fundamentally from pure software margin profiles.[CI008, CI010, CI012]

4.4 Capital Adequacy, Strategic M&A Exit, and Diligence Verdict

At-Bay's financing trajectory highlights the structural capital hurdles confronting standalone cyber insurtechs. After raising approximately $292 million to $296 million in total venture capital and reaching a peak post-money valuation of $1.35 billion following its Series D extension in October 2021, the company faced a tightening private equity climate and rising reinsurance costs. In August 2026, Munich Re Group announced a definitive agreement to acquire At-Bay in an all-cash transaction for an enterprise value of $575 million. The transaction, slated to close in early 2027 pending regulatory approvals, values At-Bay at roughly 2.0x 2025 gross written premiums. This price represents an approximate 57% contraction from its 2021 valuation mark, crystallizing a down-round acquisition outcome for later-stage venture investors. While the deal provides Munich Re's specialty arm, Hartford Steam Boiler, with proprietary cyber telemetry from more than 100,000 policy years, it underscores that high capital intensity, balance-sheet exposure, and private market valuation resets ultimately constrained At-Bay's viability as an independent venture-backed underwriting platform.[CI001, CI004, CI005, CI014]

4.5 Exhibits

5.1 Product Overview and Commercial Insurance Portfolio

At-Bay structures its commercial product portfolio around specialty property and casualty coverage tailored for small and mid-market enterprises navigating digital risks. Its core commercial insurance lines encompass primary and excess cyber insurance, standalone technology errors and omissions (Tech E&O), and miscellaneous professional liability (MPL). The company distributes these specialty coverages through licensed independent wholesale and retail insurance brokers utilizing the At-Bay Broker Platform. Rather than offering standalone unbundled risk transfer, At-Bay packages its insurance coverage with security capabilities categorized into Core, Advanced, and Complete tiers. Under this InsurSec framework, eligible policyholders obtain integrated vulnerability monitoring, employee awareness training, and virtual CISO advisory services alongside financial risk indemnification. The commercial product suite addresses both third-party liability from data breaches and direct losses stemming from system extortion, business interruption, and network failure.[CE001, CE003, CE005, CE009, CE011]

5.2 InsurSec Technical Architecture and Stance Platform

The core technical differentiator of At-Bay's InsurSec architecture is the At-Bay Stance platform, which combines external threat intelligence with automated policyholder security workflows. Central to this architecture is the At-Bay Stance Exposure Manager, a purpose-built software system that continuously inventories client digital assets, executes non-intrusive external perimeter vulnerability scans, and prioritizes discovered Common Vulnerabilities and Exposures (CVEs) against real-world exploit activity. To combat business email compromise (BEC), which represents the primary driver of commercial fraud claims, At-Bay integrates Sublime Security's agentic detection engine into its managed email security stack. Sublime's distributed detection logic evaluates message linguistics and social engineering patterns across incoming communications. Telemetry generated across endpoint, email, identity, and cloud monitoring feeds into At-Bay's managed detection and response (MDR) pipeline, creating a bidirectional feedback mechanism between digital forensics incident response (DFIR) findings and automated underwriting risk models.[CE003, CE004, CE006, CE007, CE008]

5.3 Broker Workflow Automation and Loss Prevention Performance

At-Bay operates as a licensed surplus lines broker and managing general agent across all fifty US states and the District of Columbia, relying on its proprietary digital broker portal to ingest and underwrite commercial submissions. Unlike traditional commercial underwriting workflows that depend on lengthy paper questionnaires, manual inspections, and multi-week turnaround times, At-Bay's broker platform uses programmatic domain scans to evaluate applicant security posture within seconds. The platform automatically assesses perimeter configurations, exposed ports, and email security hygiene, generating binding quotes accompanied by tailored vulnerability findings. In addition to initial placement, the system monitors policyholder digital environments throughout the policy term to detect newly emerged critical vulnerabilities. At-Bay claims that this active risk monitoring approach has reduced ransomware claim frequencies across its portfolio by up to 80% relative to broader insurance industry baselines, serving more than 35,000 policyholders across diverse commercial sectors.[CE002, CE004, CE006, CE009, CE010]

5.4 Operating Infrastructure, Carrier Dependencies, and Risk Controls

At-Bay's hybrid operating model introduces critical dependencies across technical infrastructure, carrier paper, and specialized security partnerships. The company retains approximately 15% of underwritten insurance risk, ceding the remaining 85% to institutional reinsurance partners such as Munich Re's HSB Specialty Insurance Company. On the technical side, while foundational attack surface monitoring is bundled under an Embedded Security Fee endorsement, advanced 24/7 endpoint, email, identity, and cloud managed detection and response (MDR/MXDR) requires separate contractual fees through At-Bay Security LLC. Operationally, the MDR service depends on external security partnerships, including Sublime Security for email compromise analysis and third-party endpoint telemetry providers. A major diligence consideration is that At-Bay does not expose public software development kits, open-source repositories, or developer API documentation for its proprietary risk scoring engine, requiring private technical evaluation of underwriting algorithms and internal incident response service-level agreements.[CE005, CE007, CE008, CE012, CE013, CE014]

5.5 Exhibits

6.1 Customer Segmentation and Core Target Profiles

At-Bay concentrates its commercial insurance underwriting on small-to-medium enterprises (SMBs) and mid-market organizations across the United States. Its core offering combines surplus-lines cyber insurance with Technology Errors and Omissions (Tech E&O) and Miscellaneous Professional Liability (MPL). Company public disclosures report that At-Bay protects more than 35,000 policyholders spanning over 100 industry sectors, collectively safeguarding over $800 billion in annual commercial revenue. Target customers typically possess between $1 million and $250 million in annual gross revenue—a market segment where 98% of historical cyber insurance claims originate according to industry research, but where organizations frequently lack dedicated in-house cybersecurity staff or full-time security operations centers. To serve this demographic effectively, At-Bay packages insurance coverage with tiered proactive security services branded as At-Bay Stance, ranging from baseline vulnerability scanning to active managed detection and response.[CU001, CU002, CU007, CU009]

6.2 Adoption Trajectory and Policyholder Scale

Commercial policyholder growth demonstrates steady expansion across both insurance coverage lines and value-added software security products. Public evidence documents an increase from 30,000 policyholders in late 2022 to 35,000 on At-Bay's official marketing surfaces, close to 40,000 businesses referenced in Munich Re's August 2026 acquisition announcement, and more than 53,000 small and midsize businesses reported in Forbes financial profiles as of March 2026. Alongside policyholder growth, Insurance Journal reported in August 2026 that At-Bay commands $278 million in gross written premiums while employing approximately 280 staff across the United States and Israel. In parallel with primary insurance lines, At-Bay demonstrated measurable traction in cross-selling security software: its paid Managed Detection and Response (MDR) add-on scaled from fewer than 1,000 customers in 2023 to 7,500 customers by year-end 2024, demonstrating that a meaningful subset of policyholders will purchase recurring security services directly through their cyber insurer.[CU003, CU004, CU005, CU006, CU008]

6.3 Customer Deployments, Broker Evidence, and Claims Proof

Because commercial cyber insurance policyholders and SMB insureds generally require confidentiality regarding their digital risk posture and security incidents, verified customer proof is predominantly mediated through broker partners and published claims testimonials. Commercial distribution is executed through independent retail and wholesale insurance brokers who utilize the automated At-Bay Broker Platform for quoting, underwriting customization, and binding. Broker feedback published on company channels indicates high intermediary satisfaction, highlighted by a self-reported Net Promoter Score (NPS) of 93 and testimonials emphasizing rapid claims turnaround and technical underwriting accessibility. Commercial case studies illustrate production deployments across technology providers, professional service firms, and mid-market enterprises that utilize At-Bay's vulnerability notifications to remediate critical security exposures prior to potential ransomware exploitation.[CU010, CU011, CU012]

6.4 Customer Lifecycle, Retention Dynamics, and Channel Dependencies

The customer adoption lifecycle integrates automated external risk assessment with broker placement and continuous policyholder engagement. Prior to binding, At-Bay conducts external attack-surface scans to identify security vulnerabilities, requiring applicants to address severe vulnerabilities or open ports before securing coverage. While this proactive discipline protects underwriting loss ratios, independent analysis from Kinro notes that it creates procurement friction and eliminates applicants that cannot satisfy technical requirements. Post-binding, At-Bay maintains contact through automated dark-web alerts and vulnerability notices, creating natural touchpoints for upselling Advanced and Complete Stance tiers featuring 24/7 endpoint MDR monitoring. Nonetheless, long-term customer durability remains clouded by the absence of publicly disclosed Net Revenue Retention (NRR) or cohort renewal rates, leaving At-Bay vulnerable to broker portfolio churn when competing specialty carriers offer looser underwriting terms.[CU008, CU009, CU010, CU013, CU014]

6.5 Exhibits

7.1 Regulatory Approvals, Licensing Framework, and Legal Exposure

At-Bay operates within a highly regulated insurance framework, functioning as a managing general agent and surplus-lines broker licensed across all 50 U.S. states. The company fortified its regulatory posture in January 2023 by acquiring At-Bay Specialty Insurance Company from XL Insurance America, establishing own-paper underwriting capability for eligible cyber and Technology E&O lines alongside its primary partnership with Munich Re's Hartford Steam Boiler (HSB). The paramount near-term regulatory milestone is obtaining multi-state insurance department clearances and antitrust approvals for Munich Re Group's announced $575 million all-cash acquisition of At-Bay. With transaction closing targeted for the first quarter of 2027, any regulatory delay or restructuring of operating covenants represents an immediate transactional risk. Furthermore, ongoing compliance with state surplus lines tax filings, non-admitted carrier regulations, and expanding state privacy mandates requires active legal supervision to prevent operational friction or licensing sanctions.[CR002, CR004, CR005]

7.2 Operational Execution, Threat Evolution, and Security Vulnerabilities

The core thesis of InsurSec relies on active cybersecurity risk mitigation to suppress claims frequency and loss severity relative to traditional cyber insurance carriers. At-Bay deploys its proprietary At-Bay Stance platform to conduct continuous external vulnerability scanning, threat monitoring, and managed detection and response across policyholder environments. However, operational risks persist as threat actors shift toward sophisticated social engineering, business email compromise, and multi-extortion ransomware campaigns. Industry claims reports indicate that ransomware severity reached an average of $500,000 in 2024, while At-Bay leadership acknowledged an estimated 30% increase in successful email fraud scams across commercial accounts. In addition, At-Bay underwent workforce restructuring by laying off 25 Israeli research and development employees to accelerate profitability prior to the sale. Sustaining rapid security tool innovation and 24/7 incident response readiness following head-count reductions represents a crucial operational test, particularly as competitors like Coalition and Cowbell advance predictive risk algorithms.[CR009, CR010, CR011, CR012, CR014]

7.3 Underwriting Capacity, Reinsurance Concentration, and Channel Dependencies

At-Bay's business model exhibits substantial counterparty and capital dependency, historically relying on A++ rated capacity provided by Munich Re and HSB to write commercial cyber policies. Under its underwriting structure, At-Bay retains roughly 15% of the insurance risk on its balance sheet while ceding the remaining 85% to Munich Re and participating reinsurance syndicates. This high cession rate shields At-Bay from catastrophic loss clusters but creates acute dependence on reinsurance treaty renewal terms, quota-share commissions, and capacity availability. Munich Re's acquisition agreement directly mitigates long-term capacity flight risk by bringing At-Bay into HSB's Global Specialty Insurance division. On the commercial distribution front, At-Bay distributes exclusively through independent insurance brokers via its digital broker platform. While this channel enables rapid SMB market access, it concentrates distribution leverage among wholesale brokerages that also distribute competing policies from Coalition and Cowbell, exposing At-Bay to broker commission sensitivity and channel churn.[CR001, CR004, CR006, CR007, CR013]

7.4 Financial Trajectory, Valuation Reset, and Risk Heatmap Evaluation

At-Bay's acquisition at a $575 million enterprise value crystallizes a dramatic 57% valuation reset from the $1.35 billion peak valuation it attained during its 2021 Series D financing round. Although At-Bay scaled gross written premiums sixfold from $50 million in 2021 to approximately $280 million in 2025 alongside over $30 million in cybersecurity fee revenue, the compression in venture multiples forced a transaction anchored on cash generation fundamentals rather than speculative tech valuations. Having raised approximately $300 million in lifetime venture equity, the sale provides a liquidity exit but highlights the financial limits of capital-intensive insurtech models that carry balance-sheet risk. The accompanying risk matrix synthesizes At-Bay's residual risk profile, illustrating that while M&A closing conditions and systemic ransomware aggregation carry material gross exposure, established mitigations through Munich Re integration and active Stance monitoring reduce net risk to manageable levels.[CR001, CR003, CR006, CR008, CR012, CR015]

7.5 Exhibits

8.1 Investment Thesis and Anti-Thesis

The core investment thesis for At-Bay has centered on its InsurSec model, combining cyber insurance policies with active vulnerability scanning and proprietary Managed Detection and Response through At-Bay Stance. This dual approach demonstrated tangible commercial traction, scaling premium volume to $278 million across approximately 40,000 active policyholders and expanding standalone cybersecurity fee revenues above $30 million. Furthermore, management maintained capital discipline relative to peers, raising under $300 million across seven institutional rounds, which enabled all investors and employee equity holders to achieve positive returns in the $575 million Munich Re acquisition. Conversely, the anti-thesis highlights the severe structural compression inherent in managing a venture-backed cyber MGA that cedes 85% of insurance risk to third-party balance sheets. Despite sixfold premium growth since 2021, enterprise value fell by 57% from its $1.35 billion peak, underscoring that public and strategic markets price MGA commission streams and hybrid cyber software at low single-digit premium multiples rather than high software valuations.[CV001, CV004, CV005, CV007, CV008, CV010, CV011]

8.2 Financing History and Multiple Reset

At-Bay raised approximately $292 million to $296 million in equity financing between its 2016 founding and 2022, culminating in a $1.35 billion post-money valuation at its Series D round in October 2021. During that peak funding environment, private markets valued At-Bay at an 8.4x multiple on trailing run-rate revenues. By August 2026, Munich Re Group agreed to acquire At-Bay in an all-cash transaction at an enterprise value of $575 million, scheduled to close in the first quarter of 2027 subject to customary regulatory approvals. This transaction reprices At-Bay at approximately 2.0x 2025 gross written premiums of $278 million, representing a dramatic multiple reset. CEO Rotem Iram acknowledged this macro recalibration, noting that zero-interest-rate multiples have given way to fundamental cash-generation metrics, while emphasizing that $300 million in net new capital entered the company beyond cumulative funding, ensuring profitable outcomes across capital providers and retained employees.[CV001, CV003, CV005, CV006, CV007, CV008]

8.3 Scenario Analysis and Exit Mechanics

With a signed definitive acquisition agreement, At-Bay's return distribution is dominated by transaction execution rather than long-term independent operating forecasts. In the base case (assigned an 85% probability), Munich Re successfully completes the transaction in the first quarter of 2027, absorbing At-Bay into its Hartford Steam Boiler specialty division. This delivers $575 million in cash consideration, establishing an orderly exit that insulates At-Bay from standalone capital market pressures. The bull case (10% probability) envisions transaction renegotiation or third-party overbidding, where standalone GWP scales past $400 million and cybersecurity ARR doubles to $60 million, commanding an enterprise valuation exceeding $1.0 billion. The bear case (5% probability) considers unexpected antitrust or regulatory intervention, or a systemic catastrophic cyber event prior to closing that triggers a material adverse change renegotiation below $350 million. In all cases, At-Bay's 15% risk retention structure cushions balance-sheet downside while tethering exit value to industrial partner willingness.[CV001, CV002, CV003, CV004, CV006, CV011]

8.4 Diligence Asks and Thesis-Break Triggers

Because At-Bay is in the definitive window preceding transaction closing, secondary market investors and remaining stakeholders must prioritize transaction completion risk and capitalization waterfall verification over routine SaaS operating benchmarks. Primary diligence asks include auditing the definitive merger agreement for closing conditions, regulatory filings in the United States and Israel, and potential price-adjustment mechanisms tied to loss reserve development. Additionally, diligence must confirm the exact allocation of the $575 million purchase price across Series A through Series D liquidation preference stacks to verify common stock and management retention distributions. Critical thesis-break triggers include: first, any regulatory challenge or prolonged delay from state insurance commissioners or international regulators extending closing past mid-2027; second, senior executive departures ahead of the integration into Hartford Steam Boiler; and third, adverse loss ratio spikes across At-Bay's non-admitted SMB portfolios that would jeopardize reinsurance partnership continuity.[CV001, CV002, CV007, CV009, CV011, CV013]

8.5 Exhibits