Munich Re Acquires Cyber Insurtech At-Bay for $575 Million

The Munich Re Group is further expanding its cyber insurance business and acquiring the U.S. insurtech company At-Bay. The agreed-upon enterprise value is 575 million U.S. dollars. With this acquisition, the insurance group aims to more closely integrate insurance coverage with active cybersecurity.

$575 million for At-Bay

Munich Re has entered into an agreement to fully acquire At-Bay. Subject to the necessary regulatory approvals, the transaction is expected to close in the first quarter of 2027. Following the acquisition, At-Bay will be managed by Hartford Steam Boiler (HSB). HSB is part of Munich Re’s Global Specialty Insurance segment and has been a strategic partner of At-Bay since the company’s founding in 2017.

Cyber Insurance Meets Cybersecurity

At-Bay was founded in 2017 and focuses primarily on small and medium-sized businesses in the U.S. The insurtech company combines traditional cyber insurance with technologies for the ongoing detection, monitoring, and mitigation of cyber risks.

Small businesses in particular may find this offering appealing. The threat of cyberattacks is growing, while companies often lack the personnel and financial resources to maintain a comprehensive in-house IT security organization. At-Bay therefore seeks to combine insurance with prevention. Its proprietary security platform monitors risks throughout the term of a policy and simultaneously uses the data collected for underwriting.

Munich Re sees this very combination as an important step forward for the market. Cyber insurance could increasingly evolve from a product designed to provide financial protection against losses into a platform for continuous risk management.

At-Bay is already among the larger cyber insurers in the U.S.

At-Bay employs approximately 280 people in the U.S. and Israel and, according to Munich Re, is now among the top ten cyber insurers in the United States. At the end of 2025, gross premium income totaled 278 million U.S. dollars. In addition, there was fee revenue from cyber services totaling 23 million U.S. dollars.

Based on this, the agreed-upon enterprise value of US$575 million is just under double the combined premium and service revenue for 2025. However, a direct valuation comparison is of limited significance due to the different types of revenue.

Munich Re is focusing on “InsurSec”

At-Bay refers to the combination of insurance and cybersecurity as “InsurSec.” Rather than taking action through insurance only after a successful attack, the goal is to identify and mitigate risks as early as possible. Insurance coverage, security measures, and claims handling thus merge into a single integrated system.

For Munich Re, this could bring several advantages: If risks are better identified and losses prevented, this could also improve loss ratios in the long run. At the same time, additional services related to the core insurance business will emerge.

Mike Kerner, a member of Munich Re’s Executive Board, therefore describes At-Bay as a key component of the company’s future cyber offering. In the long term, the group expects this business to develop into a strong profit driver.

From Insurtech to Part of an Insurance Group

The acquisition also highlights an interesting trend in the insurtech market. While many startups originally set out with the goal of challenging established insurers on a technological level, successful technology platforms are increasingly becoming strategically attractive acquisition targets in their own right.

In the case of At-Bay, Munich Re—or rather HSB—has supported the company since its founding. For At-Bay, the sale now means access to the capital strength, reach, and insurance expertise of one of the world’s largest reinsurers. Munich Re, in turn, is acquiring technology, established access to the U.S. SMB market, and additional expertise in active cyber defense.

The purchase price of 575 million U.S. dollars underscores the strategic importance that cyber risks have come to hold for the insurance industry. The key question will be whether Munich Re can actually use At-Bay to establish a scalable model in which insurance does not merely pay out for damages after the fact, but actively helps prevent them in the first place. Equally intriguing is the fact that Munich Re is thereby addressing an area that has often been a point of contention in the event of a claim. Will this issue now be resolved with the acquisition, or will it give rise to entirely new liability questions in the future?