Inside the tech-enabled MGA model: how Coalition, At-Bay and Corvus use continuous security scanning to underwrite cyber risk traditional carriers can't price.
The alert fired at 2:14 a.m. on a Tuesday. Coalition's scanning infrastructure had detected an exposed Microsoft Exchange server — unpatched, internet-facing — at a mid-sized logistics company that had bound a policy eleven days earlier. By 9 a.m., the policyholder's IT director had a phone call, a remediation checklist, and a deadline. The server was patched by Thursday. Six weeks later, the ransomware gang that had been scanning the same vulnerability across thousands of companies hit a competitor down the road. The competitor's carrier paid $1.1 million. Coalition paid nothing.
That is the MGA playbook in one incident: don't just price the risk — touch the risk.
Managing general agents are not new. What Coalition, At-Bay, and Corvus built is new: cyber MGAs that underwrite with live security telemetry instead of application forms. Traditional carriers ask applicants to check boxes about their controls and then trust the answers. The tech MGAs scan the applicant's actual internet footprint — open ports, exposed databases, expired certificates, known vulnerabilities — before quoting, and keep scanning for the life of the policy.
The growth has been staggering. Coalition, founded in 2017, grew to over 90,000 policyholders and achieved a valuation above $5 billion in its 2022 funding round, backed by investors including Durable Capital and T. Rowe Price. At-Bay, founded in 2016, raised over $290 million and built its underwriting around what it calls "active risk monitoring," scanning policyholder networks continuously. Corvus scaled fast enough that Travelers acquired it in late 2023 for approximately $435 million — a traditional carrier buying the MGA model rather than competing with it.
The thesis is simple: in cyber, the underwriter who sees the network writes a better book than the underwriter who reads the application. Coalition's published claims data has repeatedly shown that policyholders who remediate flagged vulnerabilities file claims at materially lower rates — the company's 2025 reporting put the gap at roughly 3x fewer claims for companies that engage with its security alerts. That is not a marketing statistic. That is a loss ratio.
The technical specifics matter, because this is where the moat is. At-Bay's platform runs external attack-surface scans that catalog every internet-facing asset a company exposes — often assets the company's own IT team has forgotten. Shadow IT is the classic find: the marketing team's abandoned WordPress server, still running, still unpatched, three years after the campaign ended. Corvus built its underwriting around a proprietary risk score derived from similar telemetry, weighting factors like email-security posture and patch cadence.
The scans also catch the ugly stuff traditional underwriting never would. Coalition's team has described finding policyholders with RDP — remote desktop protocol, the ransomware attacker's front door — exposed to the open internet, at companies whose applications swore remote access was VPN-only. The application said one thing. The port scan said another. The scan wins.
This is the data advantage in concrete terms: a traditional carrier underwrites on representations; the MGA underwrites on observations. When representations and observations disagree, observations price better.
But the playbook has failure modes, and they are worth naming honestly. Scans produce false positives. An exposed port flagged as critical might be a honeypot, or a legacy system scheduled for decommissioning, or — this happens more than vendors admit — an asset that doesn't belong to the policyholder at all, misattributed by IP-range mapping. Companies have reported receiving alarming security alerts from their MGA about vulnerabilities on infrastructure they don't own. Every false positive burns trust, and trust is the currency the active-monitoring model runs on.
There is a deeper structural critique. MGAs are distributors, not risk-takers. The actual capital behind Coalition's policies comes from capacity providers — reinsurers and carriers like Arch and Allianz. When the scan-driven underwriting model works, the MGA takes the credit and the economics; when a correlated event hits — a single vulnerability exploited across thousands of policyholders simultaneously, the nightmare scenario for any cyber book — the capacity providers take the loss. Some reinsurers have begun asking pointed questions about accumulation risk in MGA portfolios, and about whether continuous scanning creates a monoculture: if every MGA scans for the same vulnerabilities and underwrites on the same signals, the whole market's blind spots correlate.
And there is the selection question. Do the MGAs write better risks because they see better data — or because the kind of company willing to let an insurer scan its network continuously is already the kind of company that patches its servers? The 3x claims gap might measure the telemetry, or it might measure the temperament. Probably both.
The direction of travel is clear even so. Traditional carriers are not beating the MGA model; they are buying it. Travelers bought Corvus. Arch and others provide the paper behind the rest. Chubb and AIG have invested heavily in their own telemetry and pre-bind scanning capabilities — the incumbents are converging on the MGA playbook because the loss ratios demand it.
The next evolution is already visible: underwriting that moves from periodic scanning to continuous, and from external observation to internal telemetry — EDR feeds, identity-provider logs, backup verification — piped directly from policyholder to carrier. Coalition's "active insurance" framing points exactly here: the policy becomes a live connection, not an annual contract.
That raises the question the industry hasn't answered: when your insurer is continuously monitoring your network, who owns that data, and what happens to your premium when the telemetry shows you getting sloppier? The scan that saves you from the 2 a.m. alert is the same scan that can justify the 40 percent renewal increase. The MGA playbook priced what traditional carriers couldn't. The next chapter is what it does with the pricing power that data confers — and whether buyers, brokers, and regulators decide that trade was worth it.
Secure transfer via Escrow.com · info@primedomaincapital.com