Cyber Insurance Market Structure, Carriers and MGAs

On May 6, 2026, Allianz Commercial agreed to transition its entire standalone commercial cyber-insurance business to Coalition, handing pricing, product, risk mitigation, and claims for a global carrier's cyber book to a venture-backed MGA, under a minimum-ten-year alignment in which Allianz takes equity and a Coalition board seat. A 130-year-old carrier outsourcing the underwriting function of a line to an eight-year-old insurtech is a marker of where value is migrating in cyber insurance. The sections below set out the structure of that market: who the players are, how each makes money, and how the layers differ, providing the foundation for the convergence story on 24b.

How big, and who pays

Cyber insurance is still small relative to the risk it covers, but it is the fastest-growing major P&C line. Global gross written premium (GWP) is on the order of ~$15–16B in 2026 (Swiss Re estimates ~$16.4B) and is widely modeled to roughly double toward the early 2030s; broader "market" figures of ~$33–40B for 2026 appear in analyst reports but generally blend in services and use different scopes — treat the ~$16B GWP figure as the underwriting-premium anchor and the larger numbers as estimates on a wider definition. The US is ~70% of global GWP, and US direct written premium (DWP) actually fell for the first time ever — from ~$9.8B (2023) to ~$9.1B (2024) — as a soft market and rate declines outran new-policy growth. S&P projects ~15–20% cyber rate increases in 2026, i.e., the soft cycle turning.

The layers, by what they actually do

Cyber-native MGAs / "active insurance" (the value layer). A managing general agent underwrites and services policies on a carrier's paper without holding the ultimate risk — earning a fee/commission on premium it originates and manages. Cyber MGAs (Coalition, At-Bay, Cowbell, Resilience, Measured) added a twist: they pair the policy with continuous scanning, alerting, and incident response, so they don't just price risk, they reduce it. Coalition has raised ~$800M and was valued at ~$5B at its 2022 Series F; At-Bay raised ~$457M, was valued at ~$1.35B in 2021, and reported ~$155M revenue in 2024 — a revenue figure, distinct from the premium it originates on carrier paper, and the distinction matters for the pricing below.

The first arm's-length price for a scaled cyber MGA arrived in August 2026, and it prices the model as insurance distribution rather than as software. Munich Re agreed to acquire At-Bay outright at a $575M enterprise value, ending the backer relationship it had held since At-Bay's founding in 2017; the business moves inside HSB, and closing is expected in Q1 2027. At-Bay is a top-10 US cyber insurer with $278M of gross written premium at Dec 31 2025 and $23M of cyber fee service revenue, across roughly 40,000 insured businesses. The agreed value is ~2.07× gross written premium and 42.6% of At-Bay's July 2021 post-money valuation of $1.35B — a 57.4% decline over five years. Premium is not revenue: an MGA earns commission and fees on what it originates, so the true revenue multiple is higher than 2.07× and cannot be derived from what Munich Re disclosed. Against the ~$155M revenue figure carried above the implied multiple would be ~3.7× — but that figure is for 2024, is not tied to a primary document, and is not on the same basis as anything in the transaction announcement, so it is offered as an order of magnitude and not as a comp. The claim these businesses command software multiples on an insurance distribution engine is therefore not supported by the one transaction that tests it, and should be treated as a thesis about their economics rather than an observed market fact. What the print does confirm is the strategic logic: the buyer is the reinsurer that already carried the risk. Detail on 24b; transaction terms on 11.

Traditional carriers with large cyber books. Beazley, AIG, Chubb, AXA XL, Zurich, Tokio Marine, CNA, Travelers (which acquired Corvus in 2024) hold the capital and the regulatory licenses. They earn the underwriting spread but historically lacked the telemetry and tech to underwrite cyber tightly — which is why Allianz chose to use Coalition's underwriting capability rather than rebuild it. The top five cyber insurers held only ~30% share in 2024 (down from ~32%), so the carrier layer is fragmented and contestable.

Reinsurers. Munich Re, Swiss Re, Hannover Re absorb the tail and the aggregation risk — the chance that one widely used vendor failing (a CrowdStrike-style outage, a shared-library zero-day) triggers correlated claims across the whole book. Reinsurance appetite is the real governor on how much cyber capacity exists; cyber is a growing but contested reinsurance line, and constrained reinsurance is what periodically hardens the primary market.

Brokers. Marsh, Aon, Gallagher, WTW, Woodruff Sawyer advise the insured and place the risk, earning commission. Their cyber specialty practices increasingly bundle risk-quantification and benchmarking data — a quiet move up the value chain toward the underwriting function.

Why the structure is consolidating

Three engines drive cyber-insurance M&A. (1) MGA roll-ups. PE and carriers are buying fee-based MGA platforms for their scalable, capital-light economics — e.g., Blackstone Credit & Insurance + AmTrust folded seven MGAs into the standalone ANV Group (completed Dec 2025), and MGA deal volume/size has risen through 2025–2026. (2) Carrier–insurtech convergence. Travelers–Corvus (2024) and now Allianz→Coalition (announced May 6 2026) show carriers acquiring or renting the active-insurance capability rather than building it. The boundary between insuring risk and reducing it is dissolving — the through-line of 24b. (3) Carrier acquisition of cyber services. Distinct from (2), which buys underwriting technology, this buys consulting, incident-response and intelligence delivery. AXA XL agreed on Aug 6 2026 to acquire the remaining shares of S-RM, a corporate-intelligence and cyber-security consultancy in which it already held approximately 49%, and to place it inside AXA XL Risk Advisory, a business unit created for prevention; completion is expected by the end of September 2026 (11).

What separates the third engine from the wider services market is who carries the loss. A carrier holds the risk on its own balance sheet, so a claim avoided or a response shortened accrues to it directly, and it can underwrite a services business partly against claims severity in its own cyber book rather than against the services margin alone. A broker earns commission on placement and holds none of the loss, and the record in that half of the chain runs the other way: Aon sold Stroz Friedberg and Elysium Digital to LevelBlue (announced Jun 11 2025, completed Aug 1 2025, approximately 300 professionals, terms undisclosed) while retaining its cyber brokerage, CyQu platform and Cyber Risk Analyzer. The two transactions are not evidence of a single direction of travel in insurance; they separate along risk-bearing, with carriers acquiring and the broker divesting. The consequence for a services target is that its buyer universe contains a class whose valuation basis is loss-cost avoidance rather than services earnings, and the two do not produce the same price (04e, 04d).

The bound on the third engine is that it rests on two observations, one of which is a partner buying out a stake it already held. Whether carrier ownership of cyber services becomes a pattern is testable: a carrier acquiring a services firm with which it had no prior investment relationship, or a second carrier following AXA XL, would establish it; a carrier divesting such a unit would count against it.

→ Cross-references: the active-insurance convergence thesis and the Allianz–Coalition deep dive (24b); demand engines (15, 16); the buyer (03); aggregation risk mirrors platform concentration (01).

Sources: Munich Re — agreement to acquire At-Bay at a $575M enterprise value (Aug 19 2026) · At-Bay Series D — $185M at a $1.35B post-money valuation (Jul 27 2021) · AXA XL — agreement to acquire S-RM (Aug 6 2026) · LevelBlue — completion of the Aon cybersecurity and IP litigation consulting acquisition (Aug 1 2025) · Aon — LevelBlue agreement (Jun 11 2025) · Coalition–Allianz partnership (May 6 2026) — GlobeNewswire · Allianz Commercial — partnership with Coalition · Gallagher — 2026 Cyber Insurance Market Outlook · S&P Global Ratings — Cyber Insurance Outlook 2026 · Coalition Series E ($205M, >$3.5B) · Coalition Series F ($250M, $5B) — Insurtech Insights · At-Bay Series D ($185M, $1.35B, 2021) — SecurityWeek · Risk & Insurance — MGA deals surge. GWP ~$16.4B 2026 per Swiss Re estimate; US ~70% of GWP and US DWP ~$9.8B→~$9.1B per market trackers.

Updated 2026-10-04 19:34 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.