AIG vs At-Bay: How Do They Compare for Cyber Insurance?

AIG markets three distinct cyber forms: CyberEdge, CyberEdge Plus and CyberEdge PC. AIG says coverage may be bought as a standalone CyberEdge policy or endorsed onto selected Financial Lines, Property and Casualty policies; the forms are not interchangeable descriptions of one coverage grant. ³Company-reported. AIG’s U.S. CyberEdge page; endorsement availability is stated only for selected policies. AIG’s legal footer says policies are written by subsidiaries or affiliates and coverage depends on underwriting and policy language.

At-Bay places cyber insurance through its disclosed producer, At-Bay Insurance Services LLC, which is licensed as an insurance producer in all 50 states. At-Bay says eligible new excess-and-surplus (E&S) cyber business has been written on its own carrier paper, At-Bay Specialty Insurance Company, since August 2023. ^7,8Company-reported. Producer role from the current license page; carrier role from a 2023 transition announcement, not confirmed for every current cyber quote.

Confirm in your quote.

The current cyber product page does not name an issuing insurer. At-Bay's 2023 announcement says new E&S cyber business is quoted on At-Bay Specialty Insurance Company paper, but that is a historical statement, not a per-quote disclosure. ^6,8Company-reported. Cyber product page checked today names no insurer; the carrier-transition release is dated August 2023 and does not cover every current state or account.

AIG describes cyber coverage and risk services for organizations and clients. The reviewed product page does not publish a complete eligible-industry, revenue or security-control appetite; a particular applicant’s eligibility remains subject to underwriting. ³Company-reported. Audience stated by AIG on its U.S. CyberEdge marketing page; no application eligibility schedule was reviewed.

Confirm in your quote.

AIG describes CyberEdge as addressing breach-related financial costs such as response, data restoration, network interruption and cyber extortion. CyberEdge Plus is described for physical-world losses caused by a cyber event, including business interruption, property damage and physical injury; CyberEdge PC is described as excess of traditional property and casualty policies on a difference-in-conditions/difference-in-limits basis. The page says actual coverage depends on the facts and policy terms, conditions and exclusions. ³Company-reported. Product summaries on AIG’s U.S. page, preserving differences among the three forms. Examples are not a promise that any loss or expense is covered under an issued policy.

At-Bay lists direct and contingent business interruption and system failure coverage, social engineering and invoice manipulation coverage for all classes of business, full limits for cryptojacking and bricking, broad cyber extortion coverage including cryptocurrency payment, and reputational-harm coverage for PR costs from adverse publicity. ⁶Company-reported. Product-page coverage highlights; the issued policy and endorsements control actual terms.

At-Bay sells cyber insurance with optional InsurSec security tiers: Core includes vulnerability monitoring and a fraud-defense sub-limit; Advanced adds a reduced ransomware retention and a zero-hour ransomware waiting period; Complete adds a $0 financial-fraud retention and a $1 million financial-fraud sub-limit. Each higher tier requires a separately purchased managed detection and response (MDR) subscription. ⁶Company-reported. Product-page InsurSec package descriptions and footnotes; availability depends on the business's risk profile and qualifying conditions.

The reviewed page does not state standard cyber limits, retentions or sublimits. Confirm each amount and applicable form in the quote and issued policy. ³Not publicly disclosed. AIG’s U.S. CyberEdge marketing page reviewed 2026-09-30; no buyer-specific quote, application outcome or policy wording was reviewed.

At-Bay says it writes primary and excess cyber insurance for businesses with revenue up to $5 billion and limits up to $10 million. Through its Broker Platform, brokers can get automated quotes only for businesses up to $100 million in revenue and $3 million in limits. ⁶Company-reported. Published appetite ceilings, not guaranteed offers; underwriting and the appetite guide control individual accounts.

AIG describes cyber risk assessment, threat intelligence, alerts about known vulnerabilities, and a Cyber Resiliency Program. The page says these services help clients assess and improve cyber resilience; it does not promise that they prevent a breach or are available on identical terms with every form. ³Company-reported. Company-described cyber risk services on AIG’s U.S. CyberEdge page; product and account applicability should be confirmed in the quote.

Every At-Bay cyber policy includes access to At-Bay Stance, a security platform with vulnerability monitoring, vCISO advisory and tabletop exercises, and security awareness training. Managed detection and response (MDR) for endpoints or email costs extra, $16 or $25 per user per month respectively, and is sold separately by At-Bay Security, LLC. ⁶Company-reported. Product-page InsurSec and footnote descriptions; MDR pricing is described as estimated and subject to change.

AIG links a U.S. Cyber underwriting application and invites brokers to contact its national product and distribution teams. The page does not say that submitting an application results in a quote, acceptance or binding. ³Company-reported. Application and broker contact links on AIG’s U.S. CyberEdge page; no completed application or binding workflow was reviewed.

You apply for At-Bay cyber coverage by emailing a submission to underwriting@at-bay.com or by requesting an automated quote through At-Bay's Broker Platform. ⁶Company-reported. Product-page submission instructions; the Broker Platform route is limited to accounts within its lower appetite ceilings.

AIG says its cyber insureds can use a 24/7 claims hotline and that its claims team works with specialized legal and forensic firms on incident response. AIG’s example also describes assistance with regulatory disclosures and notifications. These service statements do not guarantee claim acceptance, payment or a particular response time. ³Company-reported. Company-reported services and example on AIG’s CyberEdge page; policy terms and the circumstances of a loss control any claim.

At-Bay describes an in-house claims team and a named breach-coach phone line for active ransomware or system-interruption incidents, alongside a published cyber incident roadmap that assembles response partners after a claim is reported. ⁹Company-reported. Claims-handling page process description; does not establish claim outcomes or payment speed.