At-Bay vs CFC Cyber Insurance

At-Bay places cyber insurance through its disclosed producer, At-Bay Insurance Services LLC, which is licensed as an insurance producer in all 50 states. At-Bay says eligible new excess-and-surplus (E&S) cyber business has been written on its own carrier paper, At-Bay Specialty Insurance Company, since August 2023. ^4,5Company-reported. Producer role from the current license page; carrier role from a 2023 transition announcement, not confirmed for every current cyber quote.

CFC's flagship cyber product, Cyber Proactive Response, targets businesses with revenues from $0 to $250 million and pairs the policy with built-in security monitoring, incident response and claims handling rather than selling those as add-ons. ¹¹Company-reported. Cyber insurance product page's Cyber Proactive Response summary; CFC separately sells Cyber (admitted), Corporate cyber for businesses at $250 million and up, and a Cyber excess policy.

The current cyber product page does not name an issuing insurer. At-Bay's 2023 announcement says new E&S cyber business is quoted on At-Bay Specialty Insurance Company paper, but that is a historical statement, not a per-quote disclosure. ^3,5Company-reported. Cyber product page checked today names no insurer; the carrier-transition release is dated August 2023 and does not cover every current state or account.

The Cyber Proactive Response application form names only CFC Underwriting Limited, an entity authorized and regulated by the UK Financial Conduct Authority, as the party administering the form. Neither the cyber product page nor the application discloses which specific insurer or Lloyd's syndicate capacity sits behind a US Cyber Proactive Response policy. ^14,10Not publicly disclosed. Application footer and the regulatory information page, both checked on 2026-09-23; CFC also operates Lloyd's Syndicate 1988 and CFC USA Inc.'s admitted and E&S licenses, but no page ties one of these specifically to Cyber Proactive Response.

Not described in the reviewed sources.

CFC segments cyber eligibility by revenue: Cyber Proactive Response and Cyber (admitted) are positioned for businesses with revenues from $0 to $250 million, while Corporate cyber is for businesses at $250 million and above. ¹¹Company-reported. Cyber product page product summaries; actual eligibility for a given applicant depends on underwriting.

At-Bay lists direct and contingent business interruption and system failure coverage, social engineering and invoice manipulation coverage for all classes of business, full limits for cryptojacking and bricking, broad cyber extortion coverage including cryptocurrency payment, and reputational-harm coverage for PR costs from adverse publicity. ³Company-reported. Product-page coverage highlights; the issued policy and endorsements control actual terms.

At-Bay sells cyber insurance with optional InsurSec security tiers: Core includes vulnerability monitoring and a fraud-defense sub-limit; Advanced adds a reduced ransomware retention and a zero-hour ransomware waiting period; Complete adds a $0 financial-fraud retention and a $1 million financial-fraud sub-limit. Each higher tier requires a separately purchased managed detection and response (MDR) subscription. ³Company-reported. Product-page InsurSec package descriptions and footnotes; availability depends on the business's risk profile and qualifying conditions.

Cyber Proactive Response includes crime cover, a 12-month indemnity period for business interruption, and data recreation cover, with unlimited claim reinstatements available at either no deductible or a single deductible at most. ¹¹Company-reported. Cyber product page Key features list for Cyber Proactive Response.

At-Bay says it writes primary and excess cyber insurance for businesses with revenue up to $5 billion and limits up to $10 million. Through its Broker Platform, brokers can get automated quotes only for businesses up to $100 million in revenue and $3 million in limits. ³Company-reported. Published appetite ceilings, not guaranteed offers; underwriting and the appetite guide control individual accounts.

For larger businesses, CFC's Corporate cyber product (for revenues of $250 million or more) has a published maximum line size of $25 million; the Cyber Proactive Response and Cyber (admitted) pages for smaller businesses do not publish a maximum dollar limit. ¹¹Company-reported. Cyber product page Corporate cyber Key features; limit for any individual policy appears on its declarations.

Every At-Bay cyber policy includes access to At-Bay Stance, a security platform with vulnerability monitoring, vCISO advisory and tabletop exercises, and security awareness training. Managed detection and response (MDR) for endpoints or email costs extra, $16 or $25 per user per month respectively, and is sold separately by At-Bay Security, LLC. ³Company-reported. Product-page InsurSec and footnote descriptions; MDR pricing is described as estimated and subject to change.

Every CFC cyber policyholder gets CFC Response, described as an in-house incident-response service available 24/7, plus a free mobile app offering dark web monitoring, phishing simulations and external network deep scanning. ^12,13Company-reported. Response page and cyber brochure; CFC characterizes its incident response team as one of the largest in-house teams in the industry, a claim not independently verified here.

You apply for At-Bay cyber coverage by emailing a submission to underwriting@at-bay.com or by requesting an automated quote through At-Bay's Broker Platform. ³Company-reported. Product-page submission instructions; the Broker Platform route is limited to accounts within its lower appetite ceilings.

The US Cyber Proactive Response application is a one-page form asking whether multi-factor authentication is enforced for remote network access and email, whether backups are offline or MFA-secured, and whether the business had a cyber incident in the last three years. ¹⁴Company-reported. Cyber Proactive Response application form sections on cyber security controls and previous cyber incidents.

At-Bay describes an in-house claims team and a named breach-coach phone line for active ransomware or system-interruption incidents, alongside a published cyber incident roadmap that assembles response partners after a claim is reported. ⁶Company-reported. Claims-handling page process description; does not establish claim outcomes or payment speed.

CFC says its in-house cyber claims team resolves several thousand cyber claims a year and reports a 99.4% cyber claims acceptance rate over a recent 12-month period. ¹³Company-reported. Cyber brochure claims statistics; these are company-reported figures and were not independently audited.