At-Bay Cyber Insurance Custom Case Solution & Analysis

Case Evidence Brief

1. Financial Metrics

• Total funding raised: 292 million dollars as of Series D in 2021.
• Valuation: 1.35 billion dollars post-Series D.
• Gross Written Premium (GWP): Projected to exceed 160 million dollars in 2021.
• Loss Ratio: Industry average for cyber insurance reported between 45 percent and 67 percent; At-Bay claims loss ratios significantly lower than the market average due to active monitoring.
• Broker Commission: Standard industry rates apply, typically 10 to 15 percent of GWP.
• Revenue Model: Managing General Agent (MGA) model earns commission on premiums plus profit-sharing with reinsurers.

2. Operational Facts

• Product: Cyber insurance for small and medium enterprises (SMEs) with up to 2 billion dollars in revenue.
• Underwriting Technology: Proprietary scanner evaluates the security posture of a company from the outside-in, mimicking an attacker.
• Active Monitoring: Continuous scanning of policyholders; alerts sent when new vulnerabilities (e.g., Microsoft Exchange flaws) are detected.
• Distribution: 100 percent broker-led model.
• Claims Handling: Partnership with third-party incident response firms and internal security teams.
• Headcount: Rapidly scaling from 50 to over 150 employees across offices in Mountain View and Tel Aviv.

3. Stakeholder Positions

• Rotem Iram (CEO): Believes insurance is the right vehicle to incentivize better cybersecurity. Focused on maintaining low loss ratios through technical superiority.
• Brokers: Value the speed of the At-Bay platform (quotes in minutes) and the security reports provided to clients.
• Reinsurers (Hiscox, Munich Re): Provide the balance sheet capacity. Interested in the data-driven approach to reduce tail risk.
• SME Clients: Often lack internal security teams; rely on At-Bay for both risk transfer and risk mitigation.

4. Information Gaps

• Specific reinsurance treaty terms: The exact percentage of risk retained versus ceded is not detailed.
• Churn rates: Data on policyholder retention after security alerts or premium increases is absent.
• Loss development: Cyber claims have long tails; the case does not provide longitudinal data on how 2018-2019 vintages are maturing.
• Competitor loss ratios: While At-Bay claims superiority, specific loss ratio data for direct insurtech competitors like Coalition or Resilience is not provided for direct comparison.

Strategic Analysis

1. Core Strategic Question

• Can At-Bay maintain its technical underwriting advantage as it scales from a niche MGA to a broad-market insurance carrier in a hardening market?
• How should the firm balance the capital intensity of becoming a full-stack carrier against the agility of the MGA model?

2. Structural Analysis

The cyber insurance market is shifting from a soft market (abundant capacity, low rates) to a hard market (restricted capacity, soaring rates). Applying the Value Chain lens reveals that At-Bay has successfully integrated security research into the underwriting stage, creating a temporary information asymmetry. However, the bargaining power of reinsurers remains high because At-Bay does not yet carry significant risk on its own balance sheet. Rivalry is intensifying as incumbents adopt similar scanning tools, threatening the uniqueness of the At-Bay data advantage.

3. Strategic Options

4. Preliminary Recommendation

At-Bay must transition to a full-stack carrier model. The current MGA model leaves too much profit on the table for reinsurers who are essentially rent-seeking on At-Bay technology. By becoming a carrier, the firm aligns its technical success directly with its financial upside. This move requires a significant capital raise and a build-out of the actuarial and compliance functions, but it is the only path to becoming a dominant financial institution rather than a software vendor for traditional insurers.

Implementation Roadmap

1. Critical Path

• Month 1-3: Secure state-level insurance licenses in key markets (NY, CA, TX). Establish a captive reinsurance vehicle to begin retaining a larger portion of risk.
• Month 4-6: Recruit senior actuarial leadership with experience in long-tail casualty lines. Upgrade the internal ledger and claims management systems to handle direct carrier operations.
• Month 7-12: Negotiate new reinsurance treaties where At-Bay retains 20 to 30 percent of the risk, signaling skin in the game to the market.

2. Key Constraints

• Capital Availability: Becoming a carrier requires significant statutory reserves. A market downturn could freeze the capital needed to fund this transition.
• Regulatory Friction: Each US state has different filing requirements for rates and forms. This slows down the ability to adjust pricing in response to new cyber threats.
• Talent War: Competing for security researchers in Tel Aviv and insurance executives in the US simultaneously creates organizational strain.

3. Risk-Adjusted Implementation Strategy

The strategy assumes a phased approach to risk retention. Rather than moving to 100 percent risk retention immediately, At-Bay should use a fronting arrangement for the first 18 months. This allows the firm to collect primary premiums and control the claims process while limiting exposure to a systemic cyber event. Contingency planning involves maintaining the MGA platform as a fallback if capital markets tighten, allowing the firm to revert to a capital-light model if necessary.

Executive Review and BLUF

1. BLUF

At-Bay should immediately transition from a Managing General Agent to a full-stack insurance carrier. The firm possesses a superior data set generated by its proprietary scanning technology, which results in loss ratios below the industry average. Currently, reinsurers capture the majority of the profit generated by this technical advantage. By carrying risk on its own balance sheet, At-Bay will capture the full underwriting margin and gain the autonomy necessary to price risk dynamically. The window to execute this transition is narrow; as incumbents adopt similar scanning technologies, the data advantage will erode. Success depends on aggressive capital allocation toward statutory reserves and the rapid acquisition of actuarial expertise.

2. Dangerous Assumption

The most consequential unchallenged premise is that outside-in scanning remains a valid proxy for internal security health. As attackers move toward identity-based and social engineering exploits that do not rely on open ports or unpatched software, the predictive power of At-Bay scanning technology may decline precipitously, leading to unexpected losses.

3. Unaddressed Risks

• Systemic Correlation: A single vulnerability in a ubiquitous service (e.g., AWS or Microsoft) could trigger claims across a massive percentage of the portfolio simultaneously. The analysis does not fully account for this tail risk.
• Reinsurer Withdrawal: If the broader cyber insurance market sees a string of catastrophic losses, reinsurers may exit the space entirely, regardless of At-Bay individual performance, leaving the firm without necessary capacity.

4. Unconsidered Alternative

The team failed to consider a White-Label Technology Partnership. Instead of competing as an insurer, At-Bay could license its active monitoring and underwriting platform to traditional global carriers. This would avoid the capital intensity and regulatory burden of becoming a carrier while achieving massive scale through the existing distribution networks of firms like AXA or Chubb. This path offers lower upside but significantly higher capital efficiency and lower balance sheet risk.

5. Verdict

APPROVED FOR LEADERSHIP REVIEW