In June, I wrote about two deals that pointed in the same direction: for many carriers, building a differentiated cyber platform internally is slower, riskier, and more expensive than acquiring one. That helps explain why Zurich agreed to pay $10.9 billion for Beazley: a specialty insurer with cyber underwriting roots stretching back to the late 1990s. Of course, Beazley is a specialty insurer, not an MGA, but the acquisition logic is the same. Separately, Allianz handed its standalone commercial cyber portfolio to Coalition under a ten-year exclusive agreement, only retaining its multinational and large-corporate cyber business in-house. I called this “Buy or Cede” because those two appeared to be the most credible strategies.
Three months later, Munich Re confirmed this pattern, and the earlier deals that were already visible now add up to something bigger.
Six Deals in Thirty Months
It started in January 2024, when Travelers acquired Corvus for $435 million. Zurich acquired BOXX Insurance, a prevention-focused cyber platform where I was COO, in July 2025, invested $60 million in Cowbell, and then made the defining move, agreeing in March 2026 to acquire Beazley for $10.9 billion. Allianz entered a ten-year exclusive arrangement with Coalition in May 2026 and increased its equity stake. And in August 2026, Munich Re agreed to acquire At-Bay, its long-time capacity partner, for $575 million.
The transactions are not identical. Travelers and Zurich-Beazley are outright acquisitions. Munich Re-At-Bay converts a capacity partnership into ownership. Allianz-Coalition is a long-term exclusive arrangement without full acquisition. But the direction is the same. Across six transactions in thirty months, each pairs a global balance sheet with a technology-driven cyber underwriting platform. With the notable exception of Chubb, the carriers making the largest cyber bets are buying or locking up the capability rather than building it internally.
Six deals in thirty months. The independents are running out of partners who don’t own a competing platform.
Cyber insurance has been in a soft market for four years now, with pricing down 22% from the 2022 peak and eight consecutive quarters of rate cuts through Q1 2026. The underwriting cushion is shrinking: the US cyber loss ratio climbed from 42% in 2023 to 49% in 2024 to 53% in 2025. Surplus lines carriers hit 55.9%. Third-party claims on surplus lines grew 40% year-over-year.
For an independent MGA, the squeeze is worse. On top of the costs every insurer carries, MGAs pay fronting carrier fees and ceding commissions. Publicly disclosed cyber MGA funding dropped to $49 million in 2025. The venture capital exit path used to be an IPO. Now it is mainly acquisition by a carrier. Coalition’s CEO said it publicly in May: “Naturally the market will consolidate.”
What the Carriers Are Buying
The press releases of these deals all mention “proprietary underwriting models,” “real-time risk monitoring,” and “AI-driven pricing.” But data and technology are no longer the scarcities. Cloud platforms have collapsed infrastructure cost. AI is collapsing development cost. (I wrote about this recently.) If data and technology were the true moats, carriers would have built rather than bought.
Carriers are buying time, prevention, and talent.
Time: building a mature cyber underwriting capability from scratch takes five to seven years, based on how long it took the acquired MGAs themselves to reach maturity. Acquiring one collapses that timeframe to a few months. When the Beazley deal closes, Zurich will go from outside the top ten to the largest global cyber insurer overnight.
Prevention: the MGAs commanding the highest valuations are not pure underwriters. Coalition says it scans policyholders’ networks tens of thousands of times per week; in its 2026 claims report, 64% of closed claims were resolved without out-of-pocket loss to policyholders. Beazley launched Beazley Security, a standalone cyber risk management company, in 2024. At-Bay monitors policyholders continuously and intervenes before a claim develops. At BOXX, where I ran the US operation, we built a similar model through Hackbusters, an in-house incident response team that provided early intervention without requiring a formal claim. Cyber insurance is shifting from indemnification after a cyber event to a service that prevents incidents and limits the damage when they happen. Carriers without that telemetry are pricing blind against competitors who can see a risk deteriorating and act on it before the claim develops.
Talent and culture: cyber underwriting requires people who can evaluate a company’s network architecture and price the policy at the same time. There are perhaps a few thousand professionals in the world who can do both. Coalition’s CEO came from the CIA and Goldman Sachs. At-Bay’s team includes former Israeli military intelligence analysts. They built organizations that move at a speed traditional carrier culture does not support. That capability can be built, partnered for, or acquired, but buying an established platform is the fastest route. Whether it survives the acquisition is another question.
Claims talent is equally scarce. Coordinating cyber incident response (forensics, legal notification across fifty states, ransom negotiation, business interruption quantification) requires people who understand both the technology and the coverage. The acquired MGAs built in-house claims capability alongside their vendor panels. Most carriers still outsource the entire chain.
The Counterexample
Chubb is the largest US cyber writer, leading the standalone ranking and commanding roughly a third of the package cyber market, built entirely organically. In his March 2026 shareholder letter, Evan Greenberg was blunt:
“MGAs are a bad bet in the majority of cases.”
A handful of other carriers have built cyber organically too (Tokio Marine HCC, Sompo, Arch), but none at Chubb’s scale.
Can Chubb’s organic model match the prevention and telemetry capabilities that made the acquired MGAs so valuable? Coalition and At-Bay continuously monitor policyholders and intervene before claims develop. Chubb has deep underwriting discipline and claims expertise, and its cyber team uses telemetry in underwriting, but it has not publicly emphasized an always-on monitoring and intervention model comparable to what Coalition and At-Bay do. Whether the organic model or the MGA acquisition model produces better underwriting outcomes is an open question. Chubb does not disclose cyber-specific loss ratios, but its overall underwriting discipline is well documented, and disciplined risk selection over decades is its own form of competitive advantage. The carriers that acquired or locked up MGAs were not willing to wait and find out.
What Happens to the Independent MGAs
A few significant cyber MGAs remain unattached: Resilience, Converge, Elpha Secure, and others. An MGA whose capacity partner owns a competing cyber platform is in a tenant-landlord relationship where the landlord has opened a competing store in the same building. Cyber capacity still exists elsewhere (Markel, SCOR, Arch, and others still back MGAs), but the strategic alignment gets harder when your capacity partner has a preferred platform that is not yours.
New MGAs are still launching. K2 Cyber, founded in April 2025, recruited senior underwriting talent from established cyber platforms. Navasana, founded by a former Cowbell executive, is building an AI-native cyber underwriting platform. Both are examples of senior cyber executives leaving acquired or soon-to-be-acquired platforms to start new ones. The risk for acquirers of any professional services firm is that the talent that justified the price tag walks out and competes. In some cases, it already has.
Carriers are paying billions to acquire cyber MGAs, and the people who built them can walk out and start new ones. That is the paradox of every talent acquisition in professional services, and it applies here with unusual force because cyber underwriting talent is so concentrated.
The Market Behind the Market
Lloyd’s, where roughly a fifth of global cyber premium is written, is where much of the specialty capacity originates, where coverage terms are set, and where the MGA partnerships that carriers are now acquiring were first built. Beazley operates seven Lloyd’s syndicates. When Zurich closes, it inherits a dominant position in the market where cyber terms are written. Coalition writes through Lloyd’s capacity. Many of the fronting arrangements that independent cyber MGAs depend on flow through Lloyd’s syndicates.
Owning a Lloyd’s-market cyber franchise is not just about premium. It is about direct control of capacity, influence over product and wording development, and a seat at the table where the market’s rules are written. Syndicate ownership is a form of regulatory permission that an MGA cannot replicate on its own. In a market where data and technology are becoming commodities, that structural access is one of the scarcities that still holds.
What the Cyber Market Might Look Like in 2028
The global cyber insurance market generated roughly $15 billion to $17 billion of premium in 2025, depending on the estimator. The number of writers keeps growing, and statutory concentration is falling: the top ten US writers controlled 51% of premium in 2025, down from 69% in 2019. On the surface, the market appears to be fragmenting.
At the ownership level, the opposite is happening. Four carrier-MGA combinations now control platforms that span Lloyd’s, admitted, and surplus lines, each backed by a carrier-grade balance sheet. Statutory premium may remain distributed across hundreds of writers, but the platforms shaping underwriting standards and product design are concentrating. The likely outcome is a two-tier market: four or five carrier-owned platforms with disproportionate access to talent, data, and capital markets pipelines at the top, and everyone else (niche specialists, regional players, the remaining independents) competing for the business the top tier does not want.
Six deals in thirty months have already built this structure.
What This Means for Customers and Investors
Many of the acquired MGAs were originally built to serve small and mid-sized businesses, accounts too small for traditional carrier appetites. Roughly 80% of SMBs still do not carry cyber coverage. A carrier that just paid $575 million for an MGA is going to point that platform at large corporate accounts, not the small business with 30 endpoints, no CISO, and a $2,000 annual premium. If the consolidation wave narrows the market to five platform players competing for the same large corporate accounts, the protection gap widens.
The exit path for cyber MGA investors has changed too. At-Bay was valued at $1.35 billion in its 2021 Series D. Munich Re’s $575 million deal (a different metric, but directionally clear) tells you where the market moved. Corvus returned capital through acquisition, not public markets. The IPO window seems to have closed. Coalition, last valued at $5 billion in its 2022 Series F, may be the exception. Its CEO Motta has said publicly that “our path is ultimately to become a publicly traded company.” But he cited the Euler Hermes precedent, where Allianz partnered, the company went public, and Allianz later acquired it outright.
For investors in the remaining independents and future new MGAs, the list of obvious carrier acquirers gets shorter. The thesis for new cyber MGAs is no longer “build and IPO.” It is: build a platform that a carrier still needs and has not yet locked up, and hope the timing works before the next one does.
What Happens When the Cycle Turns
All of these acquisitions were made in a soft market. The carriers buying now are betting that the cycle turns, and when it does, they want to own the underwriting capability rather than rent it. The forces that would harden the market are not hypothetical: a coordinated ransomware campaign hitting critical infrastructure, a nation-state cyberattack triggered by geopolitical conflict, a major cloud provider outage that triggers thousands of simultaneous claims across policies exposed to shared infrastructure.
From Both Sides of the Table
I have been in the corporate strategy seat at a global carrier during a post-merger integration. I have run technology strategy at another carrier. And I built and ran the US operations at a cyber MGA that Zurich acquired in 2025. So I have seen the decision these deals represent from more than one angle.
What the deal announcements miss is the fragility. A cyber MGA depends on a fronting carrier’s appetite, a reinsurer’s risk tolerance, and a regulatory framework, all outside of its control. The business model works until one of those partners changes its mind. The carriers acquiring these companies are removing part of this fragility. Whether they can maintain the speed that made these platforms valuable is a different question. Closing the deal takes a few months. Getting a carrier organization to operate at MGA speed takes years, if it happens at all.
Cyber was the first risk that moved too fast for the traditional carrier model. AI liability may be next. The carriers that figured out their cyber strategy will apply the same playbook to the next emerging risk that outpaces them.
The standalone cyber MGA is not dead. But after six deals in thirty months, the list of carriers willing to partner with one they do not own is getting shorter.
