Cyber insurance used to be a box American companies checked after a breach made the local news. In 2026, it is closer to a second security budget line, one that insurers increasingly control by dictating which tools a company must run before they will write a policy. The specialty line has grown large enough that even a single carrier like Beazley reported $571 million in cyber premiums in 2025, according to AM Best’s July 2026 analysis, underscoring how much capital now rides on this one category of risk. Three names dominate the conversation for mid-market and enterprise buyers right now: Coalition, Chubb, and At-Bay. Only one of them is about to change ownership. Munich Re confirmed on August 19, 2026 that it would acquire At-Bay for $575 million, folding a Silicon Valley-style “insurtech” into one of the world’s oldest reinsurance houses. That deal alone tells you something about where this market is heading: the insurtech upstarts proved their underwriting models work, and the balance sheets of old-line reinsurers want in.
This comparison breaks down what actually separates Coalition, Chubb, and At-Bay on price, required security controls, claims handling, and the fine print that decides whether a ransomware payout gets covered or denied. It also covers where each insurer sits after a rough two years of rising ransomware demands, and what IT and security teams need to do differently to qualify for coverage at a reasonable premium.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Why cyber insurance became a security-stack decision, not just a finance one
Five years ago, a cyber insurance application was a short questionnaire and a premium quote. Today, underwriters at Coalition, Chubb, and At-Bay run active external scans against an applicant’s domains before they even price a policy, and they will not bind coverage without proof of multi-factor authentication on email, VPN, and privileged accounts. Insurers now treat security posture as the primary rating factor, ahead of revenue or industry classification, because claims data finally gave them enough signal to do so.
The reason is simple: ransomware claims stopped being rare and expensive outliers and became the dominant cost driver of the entire line of business. At-Bay’s 2026 InsurSec report found ransomware claim severity averaging roughly $508,000 per incident, with remote-access services acting as the entry vector in 87% of the ransomware claims the insurer reviewed. Coalition’s own 2026 claims data found that 86% of its policyholders refused to pay a ransom demand outright, but the average initial ransom demand still climbed past $1 million, up 47% year over year. Insurers responded the only way underwriting can: tighten the requirements, and price risk-adjusted premiums for companies that do not meet them.
That shift explains why this comparison matters to IT and security leaders as much as it does to CFOs. The underwriting questionnaire from Coalition, Chubb, or At-Bay is, in practice, a security-control checklist, and failing it costs real money in the quote that comes back.
Coalition, Chubb, and At-Bay: who they actually are
Coalition
Coalition launched as an insurtech with a twist: it bundles active cybersecurity monitoring, its own Coalition Security platform, with the policy itself, scanning policyholder networks continuously rather than once at renewal. According to Forbes’ company profile, Coalition now serves more than 100,000 policyholders. Forge Global places Coalition’s valuation at $5.29 billion as of July 2026, following a reported $60 million Series G round, with total disclosed funding near $1.05 billion since the company’s 2017 founding. Coalition positions itself as the volume player for small and mid-sized businesses, selling through brokers and MGAs rather than direct enterprise relationships in most cases.
Chubb
Chubb is the traditional-carrier counterpoint. It is a publicly traded, globally diversified property and casualty insurer that writes cyber as one line among many, backed by one of the largest balance sheets in the industry. Chubb does not break out standalone cyber premium, policy count, or claims-paid figures in public disclosures the way a venture-backed insurtech does, so buyers evaluating Chubb are generally paying for financial strength, a global claims-handling network, and underwriting discipline built over decades, rather than a flashy telemetry dashboard. That difference in transparency is itself a data point: Coalition and At-Bay publish annual claims reports because publishing data is part of the sales pitch; Chubb does not need to.
At-Bay
At-Bay built its underwriting around continuous attack-surface scanning combined with an in-house incident response team, serving close to 40,000 U.S. businesses according to figures reported by Coverager. At-Bay generated $278 million in gross written premium and $23 million in cyber-service revenue in 2025. The company had raised close to $300 million in venture funding and reached a $1.35 billion valuation after a 2021 Series D. The headline 2026 event is the acquisition: Munich Re agreed to buy At-Bay for $575 million, a deal confirmed in Munich Re’s August 19, 2026 media release and widely covered by outlets including Insurance Business Magazine. The sale does not immediately change policy terms for existing At-Bay customers, but it does put one of the three insurers in this comparison under new ownership with reinsurance-grade capital behind it.
Coalition vs Chubb vs At-Bay: full specs comparison
The table below lines up the structural differences that matter most when a broker brings these three quotes to the table.
| Attribute | Coalition | Chubb | At-Bay |
|---|---|---|---|
| Model | Insurtech MGA, bundled security monitoring | Traditional global carrier | Insurtech MGA, attack-surface scanning plus in-house IR |
| Founded | 2017 | Chubb brand traces to 1882; modern Chubb Limited formed 2016 | 2016 |
| Ownership as of Oct. 2026 | Independent, venture-backed | Publicly traded, NYSE: CB | Being acquired by Munich Re, $575M deal confirmed Aug. 2026 |
| Reported policyholders | 100,000+ (Forbes) | Not broken out publicly for cyber | ~40,000 U.S. businesses (Coverager) |
| Target segment | SMB to lower mid-market | Mid-market to large enterprise, multinational | SMB to mid-market, tech-forward buyers |
| Free continuous security monitoring | Yes, Coalition Security platform included | Varies by endorsement or panel vendor | Yes, attack-surface scanning included |
| In-house incident response team | Partially, via Coalition Incident Response unit | Panel-based, approved vendor list | Yes, At-Bay Claims and IR team |
| Minimum control baseline | MFA, EDR, backups, risk-tier dependent | MFA, EDR, backups, higher scrutiny for large accounts | MFA, EDR, backups, remote-access hardening |
| Distribution | Broker and MGA network | Broker plus direct enterprise relationships | Broker and MGA network |
| Claims transparency | Publishes annual Cyber Claims Report | No standalone public cyber claims report | Publishes annual InsurSec Report |
| Financial strength signal | Backed by reinsurance panel, not a standalone rated carrier | Top-tier carrier financial strength rating | Backed by reinsurance panel; post-deal, Munich Re balance sheet |
| Best fit | Fast-growing SMBs wanting bundled monitoring | Large enterprises, multinational risk, regulated industries | Tech companies and mid-market firms wanting active attack-surface management |
The pattern across the “claims transparency” row is not an accident. Coalition and At-Bay both publish detailed annual reports because the data itself functions as marketing: it demonstrates the value of the monitoring tools bundled into the policy. Chubb’s silence on standalone cyber figures is typical of a diversified carrier that does not need a single line of business to carry its reputation.
Pricing: what cyber insurance actually costs in 2026
Premiums vary enormously by revenue, industry, claims history, and how well a company meets the baseline security controls above. None of the three carriers in this comparison publish a public rate card, which is standard for commercial insurance generally, but aggregated figures from brokers and insurer-reported claims data give a workable range. The pool of competitors setting that range keeps widening, too: Germany’s financial regulator BaFin counted 66 direct cyber insurers active in the market in 2025, up from 64 in 2023, in a report published in May 2026, a reminder that Coalition, Chubb, and At-Bay are competing against a growing bench even outside the US market.
| Business size | Typical annual premium range, 2026 | Notes |
|---|---|---|
| Under 250 employees | ~$1,740 median, reported down from ~$2,100 in 2024 by one broker benchmark | Reflects increased adoption of MFA and EDR lowering risk scores across the SMB segment |
| Mid-market, 250 to 1,000 employees | Low five figures to low six figures annually | Highly dependent on data volume, industry (healthcare and finance pay more), and the ransomware sublimit chosen |
| Enterprise, 1,000+ employees, $1B+ revenue | Six to seven figures annually, often layered across multiple carriers | Typically a tower of primary plus excess layers; Chubb frequently sits as primary or high-excess layer for large accounts |
| Global cyber insurance market size, 2026 | $16.4B per a Swiss Re-cited estimate, up to $23.3B per Mordor Intelligence | Estimates vary by scope definition; the Swiss Re-based figure is the more conservative benchmark |
| Munich Re-tracked global gross written premium, 2025 | ~$15B, down slightly from ~$15.3B in 2024 | Reflects softer pricing in 2025 even as claims severity rose, a classic underwriting-cycle squeeze |
That dip from $15.3 billion to roughly $15 billion is worth sitting with for a second. Premiums fell slightly between 2024 and 2025 even as At-Bay reported a 7% increase in claim frequency and Coalition reported ransom demands up 47%, and AM Best’s July 2026 figures put the industry-wide cyber loss ratio at 53.0% for 2025, a level that confirms underwriters were paying out more of every premium dollar than in recent years. That combination, rate pressure down while loss severity climbs, is exactly the setup insurers hate, and it is why all three carriers in this comparison have gotten more aggressive about pre-bind security requirements rather than simply raising price. Tightening the gate is cheaper than re-pricing an entire book of business.
Security requirements: the real underwriting checklist
Every serious cyber insurance application in 2026 asks some version of the same four questions, regardless of which of the three carriers is quoting.
- Is multi-factor authentication enforced on email, remote access such as VPN or RDP, and privileged or admin accounts, and what percentage of accounts does it actually cover? NIST’s small-business guidance treats this as the single highest-leverage control a company can deploy.
- Is endpoint detection and response deployed across workstations and servers, and is it actively monitored rather than just installed?
- Are backups offline, air-gapped, or immutable, with evidence of a successful restoration test, typically following a 3-2-1 structure?
- Does the business have a written, tested incident response plan naming legal counsel, a forensics firm, and a communications resource in advance?
Where the three carriers diverge is in how strictly they enforce these, and what counts as “required” versus merely preferred. A September 2026 broker-side comparison found that MFA, patch management, and backup requirements were treated as hard requirements by Coalition, Chubb, and most traditional carriers alike, while EDR coverage percentage, network segmentation, and security-awareness training sat in a softer preferred tier that mainly affects price rather than eligibility. At-Bay’s underwriting leans harder on remote-access hardening specifically, which tracks with its own claims data showing remote access as the entry point in 87% of the ransomware losses it paid out.
This is also where Coalition’s and At-Bay’s bundled monitoring tools create a practical advantage over Chubb for smaller buyers: both insurtechs scan a policyholder’s external attack surface automatically and flag gaps, open RDP ports, expired certificates, exposed databases, before a breach happens, effectively doing the underwriting homework and the security hygiene work in the same product. Chubb, by contrast, typically relies on an application questionnaire and, for larger accounts, a third-party security rating service, placing more of the continuous-monitoring burden on the policyholder’s own security team or managed service provider. Coalition spells out its own version of this checklist publicly, and its cyber insurance requirements guidance is a useful reference even for businesses that end up quoting with a different carrier, since the underlying controls it lists overlap heavily with what Chubb and At-Bay ask for too.
How underwriters actually price a policy
Rating a cyber policy is less like pricing a car insurance policy and more like pricing a bond: the underwriter is trying to estimate the probability and severity of a loss event over the policy period, then adding a margin for the carrier’s own cost of capital. Revenue and employee count set the initial band, since they roughly proxy for the size of the data footprint and the business-interruption exposure if systems go down. From there, industry classification matters enormously. Healthcare, financial services, and legal services carry higher base rates because they hold regulated data that triggers expensive notification and credit-monitoring obligations after a breach, while a company with no sensitive customer data and minimal downtime exposure sits in a cheaper tier regardless of revenue.
Security posture is the multiplier applied on top of that base rate, and it is where Coalition, Chubb, and At-Bay now spend most of their underwriting effort. A company that can demonstrate MFA across 100% of privileged accounts, monitored EDR on every endpoint, and a successfully tested immutable backup will typically see a meaningfully better rate than an otherwise identical company that merely claims to have “some” MFA in place. Claims history is the third major input: a business with a prior breach or ransomware payout, even one that was fully covered and resolved without incident, will usually see a surcharge at the next renewal, the same way an at-fault accident raises an auto insurance premium. Finally, the limit and sublimit structure a buyer selects, how much ransomware-specific coverage they want relative to the overall limit, how short a business-interruption waiting period they are willing to accept, directly moves the final number up or down.
Common exclusions and the war-exclusion problem
The fine print that rarely gets attention until a claim is denied is the exclusions section, and cyber policies carry a few that are unique to the category. The best known is the war and hostile-act exclusion. Lloyd’s of London began requiring its managing agents to include some form of state-backed cyberattack exclusion in standalone cyber policies starting in 2023, responding to insurer anxiety after major nation-state-linked incidents raised the possibility of a single attack generating claims across thousands of policyholders simultaneously, the kind of correlated, catastrophic loss that insurance is structurally bad at absorbing. Coalition, Chubb, and At-Bay each carry some version of this exclusion, though the exact wording, and critically, who bears the burden of proving or disproving nation-state attribution, varies by carrier and by policy form.
Other common exclusions worth checking before binding include: unencrypted portable devices (a lost laptop without disk encryption may void first-party coverage for that specific incident), prior-known-vulnerabilities (if a business was notified of a specific unpatched flaw and did not remediate it before a breach through that exact flaw, the claim can be contested), and contractual-liability carve-outs (losses arising purely from a contract the business signed, rather than from the cyber incident itself, are often excluded). None of these exclusions are unique to Coalition, Chubb, or At-Bay specifically, they are closer to industry standard, but the specific thresholds and definitions used to trigger them differ enough between the three that a broker should walk through each one explicitly rather than assuming the policy language is interchangeable.
Coverage structure: what a policy actually pays for
A cyber policy from any of these three carriers is built from the same basic components, though sublimits and triggers differ by insurer and by the limit a buyer selects at binding.
- First-party costs: forensic investigation, breach notification, credit monitoring for affected individuals, public relations and crisis communications, and data restoration.
- Business interruption: lost income and extra expense while systems are down, usually subject to a waiting period, commonly six to twelve hours, before coverage triggers.
- Ransomware and extortion: often carries its own sublimit distinct from the overall policy limit, meaning a $2 million policy might cap ransomware-specific payouts at a smaller figure unless the buyer specifically negotiates full-limit extortion coverage.
- Third-party liability: legal defense and settlements from customers, partners, or regulators following a breach, including regulatory fines where insurable by law.
- Breach coaching and incident response panel: pre-approved law firms and forensic vendors; At-Bay and Coalition route this through their own in-house or closely managed IR teams, while Chubb typically works from a panel of independent approved vendors.
The detail that trips up the most buyers is the ransomware sublimit. Because ransomware now drives a disproportionate share of large payouts even though it represents a minority of claims by volume, insurers price full-limit extortion coverage at a premium. A buyer who assumes their $5 million policy fully covers a ransomware event may discover the extortion sublimit is actually $1 million unless they specifically asked for parity.
Benchmarks: claims data from three independent sources
Rather than rely on a single insurer’s marketing numbers, it is worth triangulating claims severity and frequency across the reports each company actually publishes, plus third-party market tracking.
| Metric | Source | 2026 figure |
|---|---|---|
| Businesses refusing to pay ransom demands | Coalition 2026 Cyber Claims Report | 86% |
| Average initial ransom demand, year-over-year change | Coalition 2026 Cyber Claims Report | Exceeded $1M, up 47% YoY |
| Ransomware claim frequency, year-over-year change | At-Bay 2026 InsurSec Report | +7% |
| Average ransomware claim severity | At-Bay 2026 InsurSec Report | ~$508,000 |
| Ransomware entry vector via remote access services | At-Bay 2026 InsurSec Report | 87% of ransomware claims |
| Ransomware share of total cyber claims by volume | Industry claims aggregation across multiple carriers | ~21%, but an outsized share of large-loss payouts |
| Global cyber-insurance gross written premium, 2024 to 2025 | Munich Re-tracked market figures | $15.3B in 2024 to ~$15B in 2025 |
Reading these three sources side by side tells a consistent story even though none of them is reporting on the exact same book of business: fewer victims are paying ransoms outright, but the ones who do face bigger demands, and the attacks themselves are getting slightly more frequent rather than less. That is the opposite of what a maturing, well-defended market should look like, and it is the single biggest reason underwriting has hardened on security controls faster than it has hardened on price.
The regulatory tailwind pushing more businesses to buy
Cyber insurance demand is not rising purely because attacks are getting worse. Regulation is doing part of the work too. The SEC’s cybersecurity disclosure rule requires public companies to report material breaches within four business days, a deadline tight enough that having a carrier’s pre-vetted incident response and breach-counsel panel on retainer, rather than scrambling to find one after an intrusion is discovered, has become a practical necessity rather than a nice-to-have. State-level breach notification laws add another layer: nearly every US state now has its own notification timeline and format requirements, and a multistate breach can trigger a dozen different compliance obligations simultaneously, which is exactly the kind of coordination problem an insurer’s breach-coaching service is built to manage.
A 2026 market outlook from insurance broker Arthur J. Gallagher frames this dynamic directly: businesses are increasingly buying cyber coverage not just to transfer financial risk, but to buy access to a pre-assembled response team and a tested playbook for the exact 96-hour window regulators now expect disclosure within. That shift in buyer motivation, from pure indemnification to operational readiness, is part of why Coalition’s and At-Bay’s bundled monitoring and in-house IR teams have gained ground against the traditional model of writing a check and finding your own lawyer after the fact. It is a reasonable bet that this regulatory pressure, not pricing competition alone, is what keeps global gross written premium from falling further even in a softening rate environment.
Real-world examples: how these policies actually play out
Five scenarios illustrate how coverage, requirements, and claims experience diverge across Coalition, Chubb, and At-Bay in practice.
- The SMB that gets bundled monitoring for free. A 60-person professional services firm buys a Coalition policy and receives continuous external scanning as part of the premium. Coalition’s platform flags an expired TLS certificate and an exposed admin panel before either becomes an incident, illustrating why insurtech bundling appeals to companies without a dedicated security team.
- The multinational manufacturer that needs a tower, not a single policy. A company with $2 billion in global revenue and operations across a dozen countries cannot get adequate limits from a single insurtech MGA. It builds a tower with Chubb as the lead primary carrier and several excess layers from other global carriers, leaning on Chubb’s international claims-handling network and financial strength rating rather than a bundled security dashboard.
- The ransomware claim that hinges on remote-access hardening. A mid-market logistics company with an At-Bay policy suffers a ransomware intrusion that started through an exposed RDP port, exactly the entry vector At-Bay’s own data shows in 87% of its ransomware claims. Because the company had followed At-Bay’s required remote-access hardening, MFA plus network-level restriction on RDP, the claim proceeds without a coverage dispute over pre-bind representations.
- The acquisition that changes nothing on paper, for now. An existing At-Bay policyholder renews mid-acquisition, during the period after Munich Re’s August 2026 announcement but before the deal formally closes. Policy terms and the claims team remain unchanged in the short term, but the buyer’s broker flags that long-term product strategy, and possibly pricing philosophy, could shift once Munich Re’s reinsurance capital and risk appetite are fully integrated.
- The denied-claim scenario everyone fears. A business that represented its MFA coverage as enforced across all systems on its Coalition or At-Bay application, but in practice had MFA gaps on a handful of legacy admin accounts, faces a coverage dispute after a breach through exactly one of those unprotected accounts. This is the single most common real-world claims friction point across the industry: a misrepresentation on the application, even an unintentional one, giving the carrier grounds to contest the claim.
Use-case recommendations: which insurer fits which business
There is no universal best carrier among these three. The right fit depends heavily on company size, in-house security maturity, and whether the buyer wants bundled tooling or pure risk transfer.
- Startups and SMBs without a dedicated security team: Coalition’s bundled monitoring effectively adds a free, lightweight security function on top of the policy, which is valuable when there is no one internally watching the attack surface.
- Tech companies and SaaS businesses with cloud-native infrastructure: At-Bay’s attack-surface scanning and remote-access-focused underwriting map well onto companies whose biggest exposure is internet-facing infrastructure rather than legacy on-prem systems.
- Large, regulated enterprises in finance, healthcare, or multinational operations: Chubb’s financial strength rating, global claims infrastructure, and ability to anchor a multi-layer tower matter more than a bundled dashboard once limits climb into eight figures.
- Companies with heavy remote-work or VPN and RDP exposure: At-Bay’s underwriting focus on remote access specifically rewards, with better pricing, businesses that have already hardened that attack surface.
- Businesses planning an M&A exit or IPO: Chubb’s standing and global panel of approved breach counsel and forensics firms tends to carry more weight with institutional buyers and underwriters evaluating acquisition risk than a newer insurtech’s track record.
- Organizations wanting simplicity over customization: Coalition’s streamlined, broker-friendly binding process and straightforward control checklist suit companies that want a fast quote without a lengthy underwriting back-and-forth.
Migration guide: switching cyber insurance providers without a coverage gap
Switching carriers, whether moving off an underperforming policy or shopping the market after a renewal increase, requires more care than switching most other business insurance lines because of how claims-made coverage and prior-acts exclusions work.
- Audit your actual control coverage before shopping. Run an internal check on MFA coverage percentage, EDR deployment across every endpoint rather than just a sample, and backup restoration testing. Any gap discovered during underwriting due diligence, rather than disclosed upfront, is the leading cause of denied claims industry-wide.
- Request quotes 60 to 90 days before renewal, not at the deadline. Coalition, Chubb, and At-Bay all run active external scans as part of underwriting; a rushed timeline forces brokers to submit incomplete applications, which either delays binding or results in conservative, higher pricing.
- Confirm the retroactive date and prior-acts coverage. Cyber policies are typically claims-made. If you switch carriers, confirm the new policy’s retroactive date covers the period under your old policy, or you risk a gap where an incident that occurred under the old policy but is discovered under the new one is covered by neither.
- Negotiate the ransomware and extortion sublimit explicitly. Do not assume the headline limit applies to ransomware. Ask each of the three carriers for their specific extortion sublimit and the cost to raise it to match the full policy limit.
- Verify the incident response panel or in-house team before you need it. Ask for the actual named forensics firms and breach counsel on the panel for Chubb, or confirm the scope of the in-house team’s authority for Coalition and At-Bay, so there is no scramble during an actual incident.
- Time the cutover to avoid a lapse. Bind the new policy before the old one expires, even if it means a few weeks of overlapping premium, rather than risk even a one-day gap in coverage.
- Re-certify your application representations annually, not just at renewal. Security posture changes, such as new remote workers, new cloud services, or M&A activity, can invalidate the representations made at binding. Proactively updating the insurer through the broker on material changes reduces the risk of a denied claim citing misrepresentation.
Pros and cons: Coalition
Pros: bundled continuous monitoring at no extra cost, a fast broker-driven binding process, more than 100,000 policyholders providing a large claims dataset to refine pricing, and a published annual claims report that adds transparency.
Cons: as an MGA rather than a standalone rated carrier, financial strength depends on its reinsurance panel rather than its own balance sheet, and limits and appetite for very large or complex multinational risks are narrower than a global carrier like Chubb.
Pros and cons: Chubb
Pros: top-tier financial strength rating, global claims infrastructure across dozens of countries, the ability to write primary or excess layers at scale for the largest, most complex risks, and decades of underwriting discipline across many insurance lines beyond cyber.
Cons: no bundled security monitoring tool, limited public transparency on cyber-specific claims and pricing data, and typically a slower, more document-heavy underwriting process than the insurtech alternatives, which can disadvantage smaller buyers without dedicated risk management staff.
Pros and cons: At-Bay
Pros: a strong attack-surface scanning product bundled into the policy, an in-house incident response team with claims experience specific to the remote-access threats it tracks closely, and a published InsurSec Report that offers unusually granular claims transparency.
Cons: the pending $575 million Munich Re acquisition introduces short-to-medium-term uncertainty about product direction, pricing philosophy, and brand continuity, even though near-term policy terms are expected to remain stable through the transition.
The verdict: who should buy from whom
For a small or mid-sized business without a dedicated security function, Coalition’s combination of bundled monitoring, a 100,000-plus-policyholder claims dataset, and a straightforward binding process makes it the easiest on-ramp into cyber coverage that actually does some of the security work for you. For a tech-forward company whose biggest exposure is internet-facing infrastructure and remote access, At-Bay’s underwriting focus and in-house IR team line up with the exact entry vector, 87% of its claims trace to remote access, it is built to catch early, though buyers should ask their broker how the Munich Re acquisition might affect renewal terms over the next 12 to 24 months. For large, regulated, or multinational organizations needing eight-figure towers and the deepest possible balance sheet behind the policy, Chubb remains the carrier that global risk managers reach for first, even without a flashy bundled dashboard.
The data underneath all three choices points to the same underlying reality: ransomware demands are up 47% year over year by Coalition’s own count, claim frequency is still climbing by At-Bay’s count, and global premium volume actually dipped slightly in 2025 even as losses grew. Whichever carrier a business chooses, the security controls, MFA across every account, monitored EDR, tested immutable backups, and a written incident response plan, are no longer optional extras that make a quote a little cheaper. They are the baseline that determines whether a business can buy adequate cyber insurance at all in 2026.
Frequently asked questions
Is Coalition, Chubb, or At-Bay the cheapest cyber insurance option?
None of the three publishes a fixed rate card, and price depends heavily on revenue, industry, and security posture. As a general pattern, Coalition and At-Bay tend to be more price-competitive for small and mid-market businesses because their bundled monitoring tools lower perceived risk, while Chubb is typically priced for scale and complexity rather than for being the lowest bid on a small account.
Does the Munich Re acquisition of At-Bay affect existing policyholders right now?
Not immediately. The deal, confirmed in Munich Re’s August 19, 2026 announcement, does not change existing policy terms on its own. Buyers renewing during the transition period should ask their broker directly about any changes to underwriting appetite or pricing philosophy as the integration proceeds.
What security controls are mandatory to get any cyber insurance quote in 2026?
Across Coalition, Chubb, At-Bay, and most of the market, multi-factor authentication on email, remote access, and privileged accounts, endpoint detection and response across all workstations and servers, and offline or immutable backups with tested restoration are treated as baseline requirements rather than optional add-ons.
Will a cyber insurance policy pay the full ransomware demand?
Only up to the extortion and ransomware sublimit written into the policy, which is often lower than the overall policy limit unless a buyer specifically negotiates parity. Buyers should confirm this sublimit explicitly with their broker rather than assuming the headline limit applies.
Why did global cyber insurance premiums fall slightly in 2025 even as ransomware claims rose?
Increased competition among carriers, combined with more businesses adopting baseline security controls that lower their individual risk scores, pushed average pricing down even as claim severity and frequency climbed at the high end. That mismatch pushed the industry-wide cyber loss ratio to 53.0% in 2025, according to AM Best’s July 2026 reporting, and is part of why insurers tightened pre-bind security requirements rather than relying solely on price increases to manage loss ratios.
Can a small business with no dedicated IT security staff still get covered?
Yes, but the bundled-monitoring insurtechs, Coalition and At-Bay, are generally the easier path, since their platforms handle a meaningful share of the external scanning and alerting that a business without security staff could not otherwise provide for itself.
Do these insurers require cyber insurance applicants to use a specific EDR or MFA vendor?
No. Carriers generally require that MFA and EDR be deployed and actively monitored, not that a specific brand be used, though some insurers offer discounted pricing or streamlined applications for businesses using security vendors they have formal partnerships with.
What happens if a company misrepresents its security controls on the application?
Misrepresentation on a cyber insurance application, even unintentional, is one of the most common grounds carriers cite when contesting or denying a claim. If a breach occurs through exactly the control gap that was misrepresented, for example claiming MFA covers all systems when several legacy accounts were excluded, the insurer may have legal grounds to deny the claim.
