Summary
- Munich Re has agreed to acquire At-Bay at an enterprise value of $575 million.
- At-Bay combines cyber insurance with security services and protects close to 40,000 businesses.
- The deal gives a major European reinsurer deeper control over the security telemetry and risk data increasingly used to price cyber cover.
Munich Re has agreed to acquire cyber insurer and security provider At-Bay for an enterprise value of $575 million, deepening the German group’s position in a market where underwriting is becoming increasingly intertwined with continuous security monitoring.
The transaction is expected to complete in the first quarter of 2027, subject to regulatory approval. At-Bay will be overseen by Hartford Steam Boiler, part of Munich Re’s Global Specialty Insurance business.
At-Bay focuses on small and medium-sized organisations in the United States and combines cyber insurance with services intended to identify and reduce security exposure before a claim occurs. Munich Re says the business protects close to 40,000 companies.
The acquisition is geographically centred on the US market, but its strategic importance sits with a major European reinsurer. Cyber insurance has spent much of the past decade moving from traditional questionnaires and annual underwriting towards a model in which insurers want better technical evidence about what they are actually covering.
At-Bay’s security operation gives Munich Re another route to that evidence. Cyber insurers increasingly use information about exposed services, vulnerabilities, email security, identity controls, and other technical conditions to decide whether to offer cover, set limits, or price a policy.
That creates a closer relationship between security controls and financial risk transfer. An insurer that can observe changes in a customer’s exposure between renewal dates may be able to intervene before an incident rather than waiting to price the risk retrospectively from claims and questionnaire data.
The commercial background is less straightforward than a simple story of booming demand. Cyber insurance pricing has been under pressure as market capacity has increased, forcing underwriters to distinguish between genuine improvement in risk and simple competition for premium.
That helps explain the attraction of a security-integrated insurer. Technical monitoring can potentially improve risk selection and provide earlier evidence of deteriorating exposure. It can also create a feedback loop between underwriting decisions and the controls customers are encouraged to implement.
The model is not without governance questions. A provider that combines security services and insurance has to manage the boundary between helping a customer reduce risk and using telemetry to make underwriting or coverage decisions. The quality, transparency, and context of technical signals become important if they influence whether a business can obtain affordable cover.
For enterprise buyers, cyber insurance is already part of a wider resilience architecture involving contractual risk allocation, incident response, business interruption, legal support, and supplier requirements. As insurers acquire or build more security capability, procurement decisions may increasingly involve a bundled relationship rather than a discrete insurance policy renewed once a year.
Munich Re is already a significant participant in global cyber insurance. The At-Bay transaction therefore represents consolidation not just of premium volume, but of data and operational capability. The reinsurer is buying an organisation that sits closer to the underlying technology of its insured customers.
If the transaction closes as planned, the test will be whether the combination produces better underwriting rather than merely a larger cyber portfolio. The long-term value lies in whether security telemetry can improve decisions about risk — and whether customers see the resulting insurer as a resilience partner, a security supplier, or both.
