The cyber insurance market now collects roughly $14 billion in annual premiums and is growing at about 25% per year. Behind that growth sits a pricing problem that traditional actuarial science was never built to solve.
Conventional insurance pricing depends on historical loss data, stable risk distributions, and the law of large numbers. Auto insurers can draw on decades of claims data segmented by age, geography, vehicle type, and driving history. Homeowners insurers rely on well-modeled catastrophe data and building codes that change slowly. Cyber risk shares almost none of these characteristics.
The problems are structural. First, there is no stable loss history. Cyber insurance only became a meaningful product category around 2015, and the threat environment in 2020 looked nothing like 2025. Ransomware barely registered as a claims driver before 2018; within three years it accounted for a majority of large losses. Second, cyber risk is correlated in ways property risk is not. A single vulnerability in a widely-used software library can expose thousands of policyholders simultaneously. The MOVEit breach in 2023 affected over 2,500 organizations through one piece of file transfer software. An earthquake in San Francisco does not cause buildings to collapse in London, but a zero-day in Microsoft Exchange does hit companies on every continent at once. Third, the threat environment changes on a monthly cadence. New vulnerability disclosures, new attacker toolkits, new ransomware-as-a-service operators, and shifting geopolitical motivations make last quarter's risk model partially obsolete.
These characteristics explain why a new class of AI-native insurers emerged, and why they approach pricing from a fundamentally different direction than legacy carriers.
Outside-In Risk Assessment
The core innovation shared by companies like Coalition, At-Bay, and Cowbell Cyber is outside-in scanning. Rather than relying on self-reported questionnaires (which are notoriously inaccurate), these insurers use machine learning models to assess the actual security posture of an applicant from publicly observable data.
The process works something like this: when a business applies for coverage, the insurer's platform crawls the applicant's external-facing infrastructure. It identifies open ports, unpatched software, email authentication configurations (SPF, DKIM, DMARC), exposed admin panels, known vulnerable software versions, SSL/TLS configurations, and dozens of other signals. ML models trained on historical claims data then map these observable risk factors to expected loss probabilities.
This is genuinely different from how a traditional carrier underwrites cyber. A legacy insurer might ask "Do you use multi-factor authentication?" and accept a yes/no answer. An AI-native insurer checks whether the applicant's remote access endpoints actually require MFA, whether their email domains have proper authentication, and whether their web applications are running known-vulnerable frameworks.
Coalition: The Category Leader
Coalition has become the largest cyber insurance managing general agent in North America, writing over $1 billion in gross written premiums. Their model goes beyond underwriting into continuous monitoring. Policyholders get ongoing scanning of their attack surface throughout the policy period, with alerts when new vulnerabilities are detected.
What makes Coalition's approach distinctive is the active insurance concept. The company provides free security tools to policyholders, including a vulnerability notification system and a way to resolve common misconfigurations. The logic is straightforward: if you can prevent a breach, you avoid paying a claim. Coalition reports that policyholders who engage with their security alerts file significantly fewer claims.
Their data flywheel is now substantial. With hundreds of thousands of policyholders and years of claims data mapped to security telemetry, Coalition's pricing models incorporate a feedback loop that gets more accurate with scale. They can correlate specific observable risk factors (say, an unpatched VPN appliance) with actual claims outcomes across their book of business.
At-Bay: Security-Driven Underwriting
At-Bay takes a similar outside-in approach but emphasizes the integration between their security assessments and claims outcomes. Their underwriting platform scans applicants and produces a security rating, but the rating model is continuously retrained on At-Bay's own claims data.
The claims feedback loop matters because it grounds the model in actual losses rather than theoretical risk. Security researchers might consider a particular vulnerability critical, but if it rarely leads to successful attacks against mid-market companies (perhaps because it requires unusual conditions to exploit), the claims data will reflect that. Conversely, seemingly moderate vulnerabilities that attackers routinely use in real intrusions will show up in the loss data.
At-Bay has been particularly vocal about publishing their claims data in aggregate, producing an annual report that maps insurance claims to specific technology stacks and security configurations. This kind of transparency is rare in insurance and serves a dual purpose: it positions At-Bay as a thought leader and it gives prospective policyholders concrete evidence that their pricing model is grounded in real outcomes.
Cowbell Cyber: The SMB Play
While Coalition and At-Bay focus heavily on middle-market and larger accounts, Cowbell Cyber targets small and mid-sized businesses with an API-first platform. Their bet is that the SMB segment is both underserved and enormous. Most small businesses either lack cyber coverage entirely or carry inadequate limits.
Cowbell's technology platform is designed for distribution through agents and brokers via API integrations. A business can get a quote in minutes through an automated process that scans external risk factors and generates pricing without manual underwriter review for standard accounts. This matters for the SMB segment because the premium size on a small business policy often cannot justify the cost of manual underwriting.
Their AI models handle the initial risk assessment and pricing, with human underwriters reviewing only accounts that fall outside normal parameters. This tiered approach keeps acquisition costs low enough to profitably write policies with premiums in the low thousands of dollars.
Corvus and the Incumbent Acquisition Question
Corvus Insurance, another AI-native cyber insurer, was acquired by Travelers in 2024. The acquisition is instructive for what it says about where the market is heading.
Travelers is one of the largest commercial insurers in the United States. Their decision to buy Corvus rather than build an equivalent capability internally suggests that the technology gap between AI-native cyber insurers and traditional carriers is real and not easily closed. The scanning infrastructure, the ML models trained on cyber-specific claims data, and the engineering talent required to maintain these systems represent a meaningful barrier.
The acquisition also raises questions for the remaining independents. If large carriers can simply buy AI-native underwriting capability, the long-term competitive position of standalone cyber MGAs depends on whether they can build advantages that survive integration into a legacy carrier's operations. Coalition's scale and brand recognition provide some insulation. For smaller players, the acquisition path may end up being the most realistic exit.
Prevention Over Risk Transfer
The most interesting conceptual shift in AI-native cyber insurance is the move from pure risk transfer to active risk management. Traditional insurance is fundamentally a financial product: you pay a premium, and if something bad happens, you receive a payout. The insurer's job is to price the risk correctly and diversify the portfolio.
AI-native cyber insurers are blurring this boundary. When Coalition alerts a policyholder about an exposed RDP port, they are acting as a security vendor, not an insurer. When At-Bay's scan identifies an end-of-life firewall, they are providing security consulting. This dual role creates a different relationship with policyholders and a different economic model. Prevention costs are modest compared to breach response costs, so every prevented incident is high-ROI for the insurer.
Claims management has also shifted. When a breach does occur, NLP models can process breach notification reports, legal filings, and incident response documentation to classify claims faster and identify patterns. If multiple claims come in related to the same vulnerability or attacker group, automated clustering can flag a potential systemic event before it becomes a portfolio-level problem.
Regulatory Considerations
Cyber insurance regulation remains fragmented. In the United States, insurance is regulated at the state level, meaning 50 different sets of rules govern how policies are filed, priced, and sold. Some states have begun requiring specific cyber coverage disclosures or mandating certain risk assessment practices, but there is no uniform federal framework.
The SEC's cyber disclosure rules, which require public companies to report material cybersecurity incidents within four business days, have an indirect effect on the insurance market. As more breach information becomes public, insurers gain additional data to refine their models. Public disclosure also raises awareness of cyber risk among boards and C-suites, which tends to increase demand for coverage.
State insurance departments are beginning to scrutinize the ML models used in cyber underwriting, applying the same fairness and transparency expectations they apply to other algorithmic underwriting. Insurers using AI-based pricing will likely need to demonstrate that their models do not produce discriminatory outcomes and that they can explain pricing decisions to regulators.
What the Market Needs Next
Several gaps remain. Small business penetration is still low. Most estimates suggest fewer than 20% of SMBs carry cyber insurance, partly because awareness is low and partly because the product is still complex to buy. The API-first approach from companies like Cowbell helps, but distribution remains a bottleneck.
Systemic risk modeling needs work. The industry has not yet experienced a truly catastrophic correlated event, but the potential is real. A compromised update to a widely-used cloud service could trigger thousands of claims simultaneously. Reinsurers are pricing this tail risk conservatively, which keeps primary premiums elevated.
Claims data sharing, even in anonymized form, would benefit the entire market. Individual insurers have limited data sets compared to, say, the auto insurance industry's decades of shared loss data. Industry consortiums for cyber claims data have been proposed but have gained limited traction due to competitive concerns.
Finally, policy language needs to keep pace with evolving threats. AI-generated social engineering attacks, deepfake-enabled fraud, and attacks on AI systems themselves all present coverage questions that existing policy forms were not written to address. Insurers that can adapt their coverage terms as quickly as the threat environment changes will have a real advantage over those stuck in annual filing cycles.
The cyber insurance market is growing fast for a simple reason: digital risk is growing fast. The companies that price it most accurately, prevent the most claims, and adapt their models quickest will capture a disproportionate share of a market that shows no signs of slowing down.