Most cybersecurity M&A this year has been vendors buying vendors. Munich Re’s August 19 deal is different. A global reinsurer is buying the InsurSec stack.
Munich Re Group signed a definitive agreement to acquire At-Bay at an enterprise value of $575 million. Closing is expected in the first quarter of 2027, subject to regulatory approvals. At-Bay will sit under Hartford Steam Boiler (HSB), Munich Re’s specialty and cyber-focused arm and a strategic partner since At-Bay’s founding in 2017. That is not a LOI. It is a signed deal with a calendar.
The operating numbers are on the Munich Re release. As of December 31, 2025, on US GAAP, At-Bay recorded $278 million of gross written premiums, plus $23 million of cyber fee and service revenue. The company employs about 280 people in the U.S. and Israel, ranks itself among the top ten U.S. cyber insurers, and says it serves close to 40,000 businesses. Those are insurance metrics first. The security platform is how At-Bay differentiates the book.
Munich Re’s own framing is the thesis. The cyber market, it says, is moving from standalone coverage — which Munich Re already sells — toward integrated, continuously managed risk-mitigation platforms. HSB’s CEO called out “vertically integrated insurer-security platforms.” At-Bay’s CEO, Rotem Iram, used the InsurSec label: insurance plus security as one product for SMEs that lack a Fortune-500 security budget. The acquisition is Munich Re agreeing with that sentence at a $575 million enterprise value.
Do the multiple honestly. On $278 million of GWP, $575 million of EV is roughly 2.1× premium, before you assign any value to the $23 million fee line or the technology. Insurance deals do not price like ARR SaaS. If you treat At-Bay as a security company that happens to write policies, the multiple looks cheap. If you treat it as a specialty insurer with a software wrapper, it looks like a strategic premium for distribution and data into HSB. The press release wants you to believe the second reading while marketing the first.
Why should a security reader care? Because underwriting is becoming a control plane. When the carrier that prices the risk also runs continuous monitoring and MDR (At-Bay Stance is named on the About section of the release), security tooling stops being a separate budget fight and becomes a condition of coverage. That can pull demand toward whatever stack the insurer trusts. It can also squeeze independent MSSPs and point tools that cannot plug into binder workflows. The SME market At-Bay targets — Iram’s “90% of businesses being left behind” line — is exactly where security vendors have struggled to sell enterprise platforms.
There is a timing footnote. Close is Q1 2027, not tomorrow. Regulatory review on an insurance acquisition is real. Until then, At-Bay keeps operating, and competitors keep selling into the same SME binders. The signal still stands: one of the world’s largest reinsurers is paying more than half a billion dollars to own InsurSec rather than partner with it forever.
CyberMerge’s takeaway is narrow. This deal does not size a “cyber insurance TAM.” Do notice the product shape Munich Re is underwriting: premium plus prevention as one P&L. Security companies that ignore the insurance buyer will keep winning logos and losing the risk loop. At-Bay just got paid to prove that loop can be owned.