Cyber Insurance Brokers and Distribution
In April 2024 Aon completed its ~$13B acquisition of NFP; in November 2024 Marsh McLennan completed its ~$7.75B purchase of McGriff; and on December 9, 2024 Arthur J. Gallagher agreed to buy AssuredPartners for ~$13.45B, closing the deal on August 18, 2025 after an extended regulatory review. Three of the largest brokerage transactions in history landed inside eighteen months. None was about cyber, but all shape who controls the channel through which cyber insurance reaches the buyer. The broker is the layer that, more than any other, decides which carrier or MGA gets the risk. The sections below cover what brokers do in cyber, how they make money, how the tiers differ, and why the distribution layer is itself an M&A engine.
What a cyber broker actually does
A buyer of cyber insurance — a CISO, a CFO, a risk manager — almost never goes to a carrier directly. They go to a broker, who represents the buyer (not the insurer), assembles the submission, shops it across the market, negotiates terms and price, and — increasingly — advises on the security controls that determine whether the risk is even insurable. In cyber specifically, the broker's job is heavier than in a commodity line like auto or property, for three reasons:
The submission is technical. To get a quote, the insured must answer a detailed controls questionnaire — MFA coverage, EDR deployment, backup immutability, privileged-access management, email filtering, patching cadence. A weak submission gets declined or surcharged; a well-packaged one gets capacity and better terms. The broker is the translator between the security org and the underwriter, and the good ones run their own scans and benchmarking to strengthen the story.
The market is volatile. Cyber pricing swung violently — +100%+ rate increases in 2021–22, then double-digit decreases through 2024–25 as capacity flooded in, now turning again (S&P models ~15–20% increases re-emerging in 2026, see 24a). A broker who knows which markets are hungry, which are retrenching, and where the LMA war-exclusion language is most favorable (see 24e) extracts real value in a market this dislocated.
The claim is existential. When a ransomware event hits, the broker quarterbacks the claim — engaging the carrier's incident-response panel, the breach coach, forensics, and ransom-negotiation vendors. Claims advocacy is where brokers earn their retention, and it is the experience that compounds into renewal leverage.
How brokers make money
Brokers are paid principally by commission — a percentage of the premium, typically ~10–20% for retail commercial placement, paid by the carrier out of the premium the insured pays. Large accounts increasingly move to fee-based arrangements (a flat advisory fee in lieu of commission, for transparency). On top of base commission, brokers may earn contingent/profit commissions from carriers when a book performs well — a structure that is scrutinized for conflict because it rewards the broker for steering volume to a particular market. The economic point for M&A: brokerage is a capital-light, recurring, high-margin business — revenue renews with the policy, there is no balance-sheet risk (the broker never holds the loss), and scale compounds through data and carrier relationships. That profile is exactly why brokers trade at premium multiples and why the consolidators never stop buying.
The tiers, by what they actually do
Global retail brokers (the giants). Marsh McLennan, Aon, Arthur J. Gallagher, and Willis Towers Watson (WTW) dominate large-account placement. Marsh McLennan led all brokers for the 15th consecutive year with ~$24–25B revenue in 2025; Aon (~$15.4B) is second; Gallagher (~$11.1B) climbed to third on the back of its acquisitions; WTW slipped to fourth. Their cyber edge is scale of data and market leverage: Marsh's cyber placement volume, its proprietary loss data, and its "Cyber Catalyst" controls program give it negotiating weight no boutique can match. They serve the Fortune 1000, run dedicated cyber practices, publish closely-watched rate indices, and increasingly bundle pre-breach security advisory.
Specialist / mid-market retail. Lockton (the largest privately held broker) and Hub International punch above their size in cyber by investing in data tooling — Lockton has built broker-facing real-time cyber-risk insights to strengthen submissions. NFP (now Aon) and McGriff (now Marsh) were the middle-market consolidators the giants absorbed.
Wholesale brokers & MGAs (the access layer). When a retail broker can't place a hard-to-underwrite or specialty cyber risk through standard markets, it goes to a wholesaler (Amwins, RT Specialty, CRC) or directly to a cyber MGA (managing general agent; Coalition, At-Bay, Cowbell — see 24a/24b). Wholesalers earn an additional commission slice for accessing excess & surplus (E&S) and program capacity. The cyber MGAs collapsed the wholesale and underwriting functions together: they originate through brokers and price the risk, capturing both the distribution margin and the underwriting fee — which is precisely why they command tech multiples.
Independent specialist cyber brokers & insurtech distributors. A long tail of cyber-focused boutiques and digital distributors (and the embedded-insurance plays) round out the bottom of the funnel, often feeding the MGAs.
| Tier | Representative players | What they own | How they're paid | Cyber-specific edge |
|---|---|---|---|---|
| Global retail | Marsh, Aon, Gallagher, WTW | The large-account relationship + proprietary loss data | Commission/fee ~10–20% (+ contingents) | Scale of data, rate indices, controls programs, claims leverage |
| Mid-market / specialist retail | Lockton, Hub, Brown & Brown, NFP (Aon), McGriff (Marsh) | Middle-market & specialty relationships | Commission/fee | Data tooling, sector niches, agility |
| Wholesale / E&S | Amwins, RT Specialty, CRC | Access to specialty & program capacity | Wholesale commission slice | Markets retail can't reach; hard-to-place risk |
| Cyber MGA (broker+underwriter) | Coalition, At-Bay, Cowbell, Resilience | Buyer relationship and the underwriting brain | MGA fee + commission | Active insurance: scan, alert, intervene — see 24b |
Why distribution is an M&A engine
The brokerage roll-up is one of the most durable consolidation themes in all of financial services, and it rhymes exactly with the private-equity buy-and-build logic that drives cyber-vendor consolidation. Brokerage cash flows are recurring and capital-light; scale lowers carrier-facing costs and raises data advantage; and a fragmented long tail of regional agencies provides endless tuck-in supply. PE has been the prime mover — sponsor-backed platforms (the largest privately held brokers and aggregators) have driven thousands of agency acquisitions. The three 2024 megadeals (Aon–NFP, Marsh–McGriff, Gallagher–AssuredPartners) were the public-market expression of the same flywheel at the top of the market. For cyber specifically, control of distribution is strategic because whoever owns the broker relationship owns the data — submission data, loss data, controls data — and that data is the raw material for pricing risk and for the active-insurance models on 24b. The cyber MGAs understood this and went straight for the distribution seam.
Sources — broker rankings & megadeals: The 2026 largest insurance brokers (Brokers Bloc); Business Insurance — "Look for more big brokerage M&A" (Aon–NFP ~$13B Apr 2024; Marsh–McGriff ~$7.75B Nov 2024; Gallagher–AssuredPartners ~$13.45B agreed Dec 9 2024); Insurance Journal — Gallagher completes AssuredPartners (closed Aug 18 2025); IA Magazine — Gallagher–Woodruff Sawyer ~$1.2B; cyber broker tooling: Lockton Market Update — Cyber, Dec 2025; rate context: Gallagher 2026 Cyber Insurance Market Outlook. Commission/fee bands are illustrative industry norms.
Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.