At-Bay vs Heffernan Insurance Brokers Cyber Insurance

At-Bay places cyber insurance through its disclosed producer, At-Bay Insurance Services LLC, which is licensed as an insurance producer in all 50 states. At-Bay says eligible new excess-and-surplus (E&S) cyber business has been written on its own carrier paper, At-Bay Specialty Insurance Company, since August 2023. ^4,5Company-reported. Producer role from the current license page; carrier role from a 2023 transition announcement, not confirmed for every current cyber quote.

Heffernan says it maintains a cyber risk team with expertise in determining a client's cyber exposure, shopping the market, presenting options and guiding the selection of coverage. It arranges the policy with insurance carriers rather than underwriting cyber coverage itself. ¹⁰Company-reported. Cyber Security Insurance page's description of the cyber risk team.

The current cyber product page does not name an issuing insurer. At-Bay's 2023 announcement says new E&S cyber business is quoted on At-Bay Specialty Insurance Company paper, but that is a historical statement, not a per-quote disclosure. ^3,5Company-reported. Cyber product page checked today names no insurer; the carrier-transition release is dated August 2023 and does not cover every current state or account.

The cyber page does not name the insurer that would issue a cyber policy arranged through Heffernan. ¹⁰Not publicly disclosed. Checked the Cyber Security Insurance page on 2026-09-23. The issuing insurer would appear on the quote and declarations.

Not described in the reviewed sources.

Heffernan says cyber insurance is for any business handling sensitive customer information, relying on digital operations or storing data electronically, and names healthcare, finance, retail and technology among the industries it serves, alongside small businesses and large corporations. ¹⁰Company-reported. Cyber Security Insurance page's FAQ answer on who needs cyber insurance; this is general educational content on Heffernan's own page rather than a stated underwriting appetite.

At-Bay lists direct and contingent business interruption and system failure coverage, social engineering and invoice manipulation coverage for all classes of business, full limits for cryptojacking and bricking, broad cyber extortion coverage including cryptocurrency payment, and reputational-harm coverage for PR costs from adverse publicity. ³Company-reported. Product-page coverage highlights; the issued policy and endorsements control actual terms.

At-Bay sells cyber insurance with optional InsurSec security tiers: Core includes vulnerability monitoring and a fraud-defense sub-limit; Advanced adds a reduced ransomware retention and a zero-hour ransomware waiting period; Complete adds a $0 financial-fraud retention and a $1 million financial-fraud sub-limit. Each higher tier requires a separately purchased managed detection and response (MDR) subscription. ³Company-reported. Product-page InsurSec package descriptions and footnotes; availability depends on the business's risk profile and qualifying conditions.

Heffernan describes cyber policies it arranges as covering costs from a cyber incident, such as data recovery, legal fees, notification expenses and business interruption, and says a policy can also provide access to incident-response experts, including IT forensics specialists and public relations advisors. ¹⁰Company-reported. Cyber Security Insurance page's coverage description and FAQ; specific insuring agreements, sublimits and exclusions depend on the policy form selected.

At-Bay says it writes primary and excess cyber insurance for businesses with revenue up to $5 billion and limits up to $10 million. Through its Broker Platform, brokers can get automated quotes only for businesses up to $100 million in revenue and $3 million in limits. ³Company-reported. Published appetite ceilings, not guaranteed offers; underwriting and the appetite guide control individual accounts.

The cyber page does not publish specific limits or retentions for a Heffernan-arranged cyber policy; its FAQ gives only a general premium range of a few hundred to several thousand dollars annually across the market. ¹⁰Not publicly disclosed. Checked the Cyber Security Insurance page on 2026-09-23.

Every At-Bay cyber policy includes access to At-Bay Stance, a security platform with vulnerability monitoring, vCISO advisory and tabletop exercises, and security awareness training. Managed detection and response (MDR) for endpoints or email costs extra, $16 or $25 per user per month respectively, and is sold separately by At-Bay Security, LLC. ³Company-reported. Product-page InsurSec and footnote descriptions; MDR pricing is described as estimated and subject to change.

Beyond claim payment, Heffernan says a cyber policy can give access to incident-response experts such as IT forensics specialists and public relations advisors, and that its cyber risk team helps with exposure assessment and coverage selection before a policy is bound. ¹⁰Company-reported. Cyber Security Insurance page's services description.

You apply for At-Bay cyber coverage by emailing a submission to underwriting@at-bay.com or by requesting an automated quote through At-Bay's Broker Platform. ³Company-reported. Product-page submission instructions; the Broker Platform route is limited to accounts within its lower appetite ceilings.

Heffernan's FAQ says getting cyber insurance starts with assessing your business's data types and cybersecurity measures, then working with an experienced broker to obtain and compare quotes from multiple providers. ¹⁰Company-reported. Cyber Security Insurance page's 'How Do I Get Cyber Insurance?' FAQ answer.

At-Bay describes an in-house claims team and a named breach-coach phone line for active ransomware or system-interruption incidents, alongside a published cyber incident roadmap that assembles response partners after a claim is reported. ⁶Company-reported. Claims-handling page process description; does not establish claim outcomes or payment speed.

Not described in the reviewed sources.