Munich Re to buy At-Bay for $575m as cyber insurance shifts toward security tech

Münchener Rückversicherungs-Gesellschaft Aktiengesellschaft in München, better known as Munich Re (Xetra: MUV2), has agreed to acquire At-Bay, Inc. at an enterprise value of $575 million, bringing a U.S. cyber insurer, security platform and managed detection capability under the group’s HSB specialty insurance operation. At-Bay generated $278 million of gross written premiums in 2025 plus $23 million of cyber fee service revenue and has developed into a top-10 U.S. cyber insurer after working with HSB as a strategic partner since its founding in 2017. The company provides insurance protection and security-prevention services to close to 40,000 U.S. businesses representing as much as $800 billion of collective business revenue. The transaction is expected to close in the first quarter of 2027, subject to customary conditions and regulatory approvals, and Munich Re is positioning the acquisition around a shift from standalone cyber policies toward continuous risk monitoring, security and insurance delivered through one platform.

The price creates one of the most interesting angles in the transaction. At-Bay raised $185 million in a Series D round in 2021 at a reported post-money valuation of approximately $1.35 billion, while Munich Re is now acquiring the business at an enterprise value of $575 million. The two valuation measures are not directly equivalent because one was a private equity valuation and the other is enterprise value years later, but the gap still illustrates how dramatically investor expectations for cyber insurtech have reset. At the same time, At-Bay has become a substantially larger operating business, making the lower headline valuation particularly notable.

What does Munich Re’s $575 million price imply relative to At-Bay’s insurance business?

At-Bay’s $278 million of 2025 gross written premiums means the $575 million enterprise value equals roughly 2.1 times annual gross written premiums. Including the disclosed $23 million of cyber fee service revenue provides additional context, although insurance premiums and service revenue are economically different and should not simply be combined into a conventional sales multiple.

The roughly two-times-premium valuation appears more restrained than the valuations cyber insurance startups attracted during the funding boom earlier in the decade. At-Bay’s reported 2021 valuation exceeded $1 billion at a time when investors expected cyber insurance to expand rapidly as ransomware losses, cloud adoption and digital transformation increased demand for coverage.

What has changed is the competitive environment. Cyber insurance rates have been falling as additional capacity enters the market, with industry pricing declining even as cyber incidents remain costly. Reuters Breakingviews reported that cyber rates fell about 4% year over year in the second quarter of 2026, continuing a multi-quarter pricing decline.

For Munich Re, softer pricing can create an acquisition opportunity if it believes At-Bay’s underwriting data and security capabilities are more valuable over a full insurance cycle than today’s valuation suggests. Buying when premium pricing is under pressure is very different from acquiring a cyber insurer during a peak valuation environment.

Why does Munich Re want cybersecurity technology inside an insurance business?

Traditional insurance primarily prices risk and pays claims after losses occur. At-Bay’s model attempts to intervene earlier by continuously monitoring insured companies for vulnerabilities and offering security tools designed to reduce the probability or severity of cyber incidents. Munich Re says the combination reflects an industry shift toward vertically integrated insurer-security platforms rather than standalone coverage.

That structure can improve insurance economics in several ways. Security monitoring creates information about the customer’s actual technology environment, giving underwriters more data than a questionnaire completed once a year. Detecting exposed services, compromised credentials or unpatched vulnerabilities can also create opportunities to reduce risk before an incident becomes a claim.

At-Bay’s Stance offering extends the model into managed detection and response, creating fee revenue separate from the insurance policy. This can potentially deepen the customer relationship and reduce dependence on premium pricing if security services become a larger source of recurring revenue.

The concept resembles telematics in automobile insurance, where insurers can use operational data to better understand risk rather than relying exclusively on historical categories. Cybersecurity is more dynamic because a company’s exposure can change within hours after a vulnerability becomes public, making continuous information potentially even more valuable.

Why is HSB central to the At-Bay acquisition rather than simply Munich Re owning it directly?

HSB has been a strategic partner of At-Bay since the company’s early years and has helped support its growth into a top-10 U.S. cyber insurer. After the transaction closes, At-Bay will be overseen by HSB within Munich Re’s Global Specialty Insurance business. This provides continuity because the buyer is not introducing an entirely unfamiliar underwriting partner after acquisition.

HSB brings insurance capacity, technical risk expertise and distribution relationships, while At-Bay contributes a digital platform, security data and direct experience serving smaller businesses. The complementary assets are particularly relevant in the small and medium-sized enterprise market, where companies face increasingly sophisticated attacks but often cannot maintain security teams comparable with large corporations.

Munich Re identifies this protection gap as a central opportunity. At-Bay says it protects close to 40,000 businesses, but the U.S. SME universe is vastly larger, giving the combined business significant theoretical room for expansion. The practical challenge is reaching those customers economically while maintaining underwriting discipline as cyber threats change.

HSB’s involvement may make scaling easier because existing insurance channels can distribute At-Bay products without requiring the insurtech to acquire every customer directly. If successful, the transaction could turn At-Bay from a specialist cyber insurer into a technology layer distributed through a much larger insurance organization.

Why could cyber insurance pricing make the deal either unusually attractive or unexpectedly difficult?

Cyber insurance has an unusual economic tension. The underlying risk continues increasing as ransomware, credential theft, cloud compromise and supply-chain attacks become more sophisticated, yet insurance pricing can fall when insurers add capacity and compete aggressively for attractive customers.

Falling premiums can be good for customers but dangerous for insurers if rates decline faster than expected losses. Underwriting quality therefore matters enormously because a company that prices cyber risk incorrectly may discover the mistake only after a wave of claims arrives.

At-Bay’s security platform gives Munich Re a potential mechanism for improving that equation. Better real-time risk information can help determine which businesses deserve favorable pricing and which need remediation before receiving coverage. Proactive security services may also reduce claims directly, allowing an insurer to accept lower premiums without sacrificing profitability if loss frequency falls enough.

None of that is guaranteed. Cyber attackers adapt rapidly, and models built on historical incident data can become less useful when new attack techniques appear. The acquisition therefore places Munich Re deeper inside the cybersecurity operating environment while also exposing it to the technology execution required to keep At-Bay’s monitoring platform relevant.

Does the acquisition price make At-Bay look cheap compared with its 2021 valuation?

On the surface, yes. A $575 million enterprise value is far below the approximately $1.35 billion post-money valuation associated with At-Bay’s 2021 Series D. The apparent decline is roughly 57%, although comparing the two figures directly overstates the precision because equity value and enterprise value account differently for cash and debt.

The comparison is nevertheless strategically useful. At-Bay has continued developing its business since 2021, generated $278 million of gross written premiums in 2025 and built a large insured customer base, yet the acquisition price sits well below the valuation investors assigned during the private-market boom.

That indicates the transaction is taking place after a significant reset in fintech and insurtech valuation expectations. Companies are now being judged more heavily on underwriting economics, recurring service revenue and sustainable margins rather than simply customer growth and total addressable market.

For Munich Re, buying after that reset can be advantageous if At-Bay’s platform continues growing under a better-capitalized owner. For earlier investors, however, the transaction also demonstrates that strategic progress does not automatically preserve venture-era valuations.

How has Munich Re stock reacted to the At-Bay deal?

Munich Re shares on Xetra closed at €516.40 on August 21, up 0.62% in the session. The stock was essentially flat over five subsequent trading sessions compared with the August 14 close of €517.80, while it remained roughly 1% to 2% above late-July levels depending on the exact reference session. Its recent 52-week range stood at approximately €437.40 to €575.60.

The acquisition itself produced no dramatic sustained market reaction. Shares fell 1.7% on August 19, the announcement date, before partially recovering by August 21. That muted response is understandable because $575 million is relatively modest for Munich Re, which generated €60.4 billion of insurance revenue and €6.1 billion of net profit during 2025.

The strategic importance is therefore greater than the immediate financial scale. At-Bay gives Munich Re a platform where insurance underwriting, cybersecurity monitoring and managed security services operate together, potentially allowing it to learn more about cyber risk while generating additional fee revenue.

The next proof points will be growth in gross written premiums, cybersecurity service revenue, loss ratios and customer retention after At-Bay joins HSB. If those metrics improve, the $575 million acquisition could look like a relatively inexpensive route into a more integrated cyber-risk model. If softer insurance pricing overwhelms the benefits of security integration, the lower valuation may simply reflect a market that has become structurally more difficult.