At-Bay vs THREE by Berkshire Hathaway: How Do They Compare for Cyber Insurance?

At-Bay places cyber insurance through its disclosed producer, At-Bay Insurance Services LLC, which is licensed as an insurance producer in all 50 states. At-Bay says eligible new excess-and-surplus (E&S) cyber business has been written on its own carrier paper, At-Bay Specialty Insurance Company, since August 2023. ^4,5Company-reported. Producer role from the current license page; carrier role from a 2023 transition announcement, not confirmed for every current cyber quote.

THREE presents Cyber as a component of its combined Business Owners Policy rather than identifying it as a separate standalone policy on the reviewed product page. ⁹Company-reported. Company-described U.S. package structure. The page does not establish underwriting terms or that every listed category will be included for every applicant.

The current cyber product page does not name an issuing insurer. At-Bay's 2023 announcement says new E&S cyber business is quoted on At-Bay Specialty Insurance Company paper, but that is a historical statement, not a per-quote disclosure. ^3,5Company-reported. Cyber product page checked today names no insurer; the carrier-transition release is dated August 2023 and does not cover every current state or account.

The linked sample policy's declarations identify Berkshire Hathaway Direct Insurance Company as issuer. ⁸Company-reported. This is the issuer named on the public sample only; the sample does not establish the issuing entity for every state-specific quote or buyer's issued policy.

Confirm in your quote.

The reviewed product page does not state separate eligibility rules for Cyber; the general quote and advisor route is not proof that a particular business qualifies for it. ^9,7Not publicly disclosed. Eligibility and state availability remain unestablished for an individual risk until THREE returns its quote and applicable forms.

At-Bay lists direct and contingent business interruption and system failure coverage, social engineering and invoice manipulation coverage for all classes of business, full limits for cryptojacking and bricking, broad cyber extortion coverage including cryptocurrency payment, and reputational-harm coverage for PR costs from adverse publicity. ³Company-reported. Product-page coverage highlights; the issued policy and endorsements control actual terms.

At-Bay sells cyber insurance with optional InsurSec security tiers: Core includes vulnerability monitoring and a fraud-defense sub-limit; Advanced adds a reduced ransomware retention and a zero-hour ransomware waiting period; Complete adds a $0 financial-fraud retention and a $1 million financial-fraud sub-limit. Each higher tier requires a separately purchased managed detection and response (MDR) subscription. ³Company-reported. Product-page InsurSec package descriptions and footnotes; availability depends on the business's risk profile and qualifying conditions.

THREE's Business Owners Policy page lists Cyber Liability among its marketed coverage categories in the combined policy. This describes the product page, not whether the category appears in a particular quote or responds to a loss. ^9,8Company-reported. Official THREE package marketing for Cyber. The sample policy is state-selectable and does not establish that this item is included in every quote or issued policy.

At-Bay says it writes primary and excess cyber insurance for businesses with revenue up to $5 billion and limits up to $10 million. Through its Broker Platform, brokers can get automated quotes only for businesses up to $100 million in revenue and $3 million in limits. ³Company-reported. Published appetite ceilings, not guaranteed offers; underwriting and the appetite guide control individual accounts.

The reviewed public product page does not state a separate limit or deductible for Cyber; THREE says the quote-specific insurance summary lists limits and deductibles. ^9,8Not publicly disclosed. No number is inferred from the sample policy. The quote and issued declarations control the buyer-specific limit and deductible.

Every At-Bay cyber policy includes access to At-Bay Stance, a security platform with vulnerability monitoring, vCISO advisory and tabletop exercises, and security awareness training. Managed detection and response (MDR) for endpoints or email costs extra, $16 or $25 per user per month respectively, and is sold separately by At-Bay Security, LLC. ³Company-reported. Product-page InsurSec and footnote descriptions; MDR pricing is described as estimated and subject to change.

Confirm in your quote.

You apply for At-Bay cyber coverage by emailing a submission to underwriting@at-bay.com or by requesting an automated quote through At-Bay's Broker Platform. ³Company-reported. Product-page submission instructions; the Broker Platform route is limited to accounts within its lower appetite ceilings.

THREE directs small-business prospects to an online quote and says licensed Small Business Advisors can help with the process. ⁷Company-reported. This is the route for the overall THREE product. It does not show whether Cyber will be offered for a particular business or whether a customer can bind that line without an issued policy.

At-Bay describes an in-house claims team and a named breach-coach phone line for active ransomware or system-interruption incidents, alongside a published cyber incident roadmap that assembles response partners after a claim is reported. ⁶Company-reported. Claims-handling page process description; does not establish claim outcomes or payment speed.

Confirm in your quote.