Illustrative strategic blueprint
An independent, illustrative framework for an evidence-led cyber MGA: market conditions, underwriting factors, risk appetite, product design, capacity architecture, economics and launch milestones. Published so operators, advisers and capacity partners can argue with the assumptions rather than guess at them.
Please read first
This is an illustrative technology-led MGA blueprint. Astragar is a cyber risk intelligence software provider. It does not underwrite insurance, bind coverage, supply capacity or act as an MGA formation adviser. Insurance, actuarial, legal and regulatory decisions remain with the relevant licensed and authorised parties.
6 deals
Carrier acquisitions of or exclusives over cyber platforms in thirty months, which has narrowed the pool of unconflicted paper
53%
US cyber loss ratio in 2025, up from 48.7% in 2024, against eight straight quarters of rate reduction (NAIC, 2026)
~1%
Of global economic cyber losses are covered by insurance, so the binding constraint is an unsold market rather than a priced one (NAIC, 2026)
The market you are launching into
Four conditions hold at once. Capacity has consolidated, reinsurance capital is abundant and cheap, rate is falling into a rising loss ratio, and most of the market is still unsold. The NAIC's 2026 report puts the US cyber loss ratio at 53% for 2025 against 48.7% in 2024, with the first quarter of 2026 the eighth consecutive quarter of rate reductions. On that reading, a narrow, evidence-priced entry backed by the programme's own capital looks like the more defensible route.
Travelers bought Corvus. Zurich bought BOXX, invested in Cowbell, then closed a $10.9bn acquisition of Beazley in October 2026. Allianz took a ten-year exclusive with Coalition. Munich Re agreed to buy At-Bay for $575m, roughly 2x its $278m of premium and well under its $1.35bn 2021 valuation. The pool of unconflicted paper has narrowed, which favours a fronting carrier plus a reinsurance panel over a single binder.
Broker commentary through 2026 reports cyber quota-share ceding commissions in the mid-30s and double-digit reductions on cyber catastrophe excess of loss at the January and April renewals. Treat the specific percentages as directional until confirmed against a named broker renewal report.
Modelling premium growth from rate looks unsafe on this evidence; unit growth in an underpenetrated segment is the more defensible assumption. A commission-only MGA in a soft market sees revenue fall broadly in step with rate, with little offset and little lag.
Munich Re puts small-business cyber penetration at 10% to 20%, and the NAIC reports that insurance covers only about 1% of global economic cyber losses. US policies in force rose 33% in 2025 while premium grew 3.5%, so growth is coming from units rather than rate. That favours an evidence-led, channel-led MGA over a price-led one.
What a capacity review actually tests
Documented factor ranges, a loss-cost derivation and a signed actuarial opinion. A score with no algorithm behind it does not pass a capacity review.
Underwriters now discount what the insured says about itself. Evidence that was observed rather than declared is the difference between a surcharge and a credit.
A written appetite and a hard-decline schedule is a reinsurer-facing credibility document, and it saves the broker time on every risk that was never going to bind.
Technology-concentration caps agreed up front, monitored monthly, reported in the format the carrier and the reinsurer asked for.
Among the hardest questions a cyber MGA faces in 2026: if the underwriting is better, why is none of your own money behind it? A retained quota share is one of the few answers that tends to land.
Version control, a change log and back-testing on every rating factor. Reinsurers will ask how the model changed and what that did to rate adequacy.
Proposed underwriting factors
Astragar can measure exposure continuously and express it in financial terms. The factor structure below shows one way an MGA could carry that evidence into an underwriting framework. The ranges are illustrative only. Any use as formal rating factors requires the MGA's own actuarial calibration, documentation and approval, and sign-off from its capacity providers.
Illustrative, not actuarially validatedPremium =
[ Base Loss Cost(class, revenue band) x Exposure Units ]
x ILF(limit) ~ (Limit / $1m) ^ 0.65
x Retention Factor
x Record / Data Classification Factor
x Exposure Posture Factor 0.60 to 2.50 (capped)
x Human-Layer Control Factor 0.75 to 1.60
x Dependency Concentration Factor 0.90 to 1.45
x AI Governance Factor 0.95 to 1.25
x Recoverability Factor 0.70 to 1.40
x Claims & Loss History Factor
x Validation Credit 0.88 to 1.00
+ Risk Load + Expense Load + Profit LoadFactors would plug into the MGA's own loss costs and its own expense and profit loads. Astragar supplies measurement and the evidence chain. The rate level, the loss-cost derivation, the actuarial opinion and the filed or binder-approved rating plan remain the MGA's responsibility.
The structural idea
Most published rating approaches treat a control as present or absent. Few appear to price how well it is known to be present. Making the evidence grade a factor would give the insured a reason to keep the platform deployed, the channel a reason to supply evidence, and the reinsurer a quality signal across the book. The credits below are illustrative and would require actuarial validation before use.
Illustrative credits, not proven discountsThe insured says the control is in place. No credit. This is where most of the market still prices every risk it writes.
Astragar sees the control operating, continuously, from outside and inside. Attestation becomes observation.
The managed provider or broker validates the evidence and the platform corroborates it. Two independent sources on the same control.
Hard gates, not surcharges
A written decline schedule tends to read as a credibility document to a capacity provider and saves broker time on risks that were never going to bind. Astragar can supply the measured evidence behind each criterion so a decision is documented and auditable. The criteria themselves, and every accept, refer or decline decision, are set and made by the MGA.
Illustrative criteriaTarget segments
The sections that follow are a worked illustration, published so operators, advisers and capacity partners can argue with the assumptions rather than guess at them. No programme described here exists, and nothing here is an offer of insurance or an offer to build, fund or operate an MGA.
Already produce examination-grade control evidence under FFIEC and NCUA, already have a named security officer, already buy cyber, and are underserved by coastal brokers.
NAIC Insurance Data Security Model Law compliance generates the evidence as a by-product, and peer referral in this segment is unusually strong.
HIPAA Security Rule evidence already exists and high record counts price well. Provider risk stays out of appetite until the book has credibility.
Accounting, legal, benefits administration and wealth management carry the funds-transfer-fraud exposure where the mispricing actually sits.
The channel's own pain point and the strongest recruitment tool, but the aggregation exposure is severe. A phase-two class with hard per-partner caps from day one.
The common thread: segments that already produce examination-grade control evidence as a cost of doing business. The expensive part of cyber underwriting is already paid for by the regulator.
Product design
Funds transfer fraud and other human-deception losses carry some of the market's lowest sublimits while accounting for a large share of incurred loss in several published carrier books. A soft market makes a cleaner form more affordable, and verified payment controls could make a materially higher funds-transfer-fraud limit easier to defend to a reinsurer. Positions below are illustrative drafting options, not a filed or approved wording, and the cause-of-loss split behind them needs confirming against a named claims study before publication.
Illustrative coverage positionsCapacity architecture
Capacity is reported to run three to ten months and is the workstream whose failure does most to make the rest redundant. On the illustrative figures below it also accounts for roughly six to seven turns of exit multiple, which is much of the financial case for a panel over a single carrier. The MGA and its appointed brokers and advisers arrange all of this.
Three to five cyber-experienced reinsurers, plus cyber catastrophe excess of loss above the quota share. Assembled reinsurer-first, through a cyber-specialist reinsurance broker, targeting reinsurers reported to be carrying unmet deployment targets. The MGA and its appointed reinsurance broker arrange this.
Retains 10% to 20%. Expect a 4% to 7% ceding fee plus expense recovery in a hybrid structure, or 5% to 15% all-in on a harder programme. Negotiate the collateral requirement as hard as the fee, because it is the line that breaks start-up cash flow.
10% of every risk at launch, scaling with surplus. Iowa House File 2766, signed on 15 May 2026 and effective 1 July 2026, cut the minimum capital and surplus for a protected cell captive company from $500,000 to $100,000, with each cell capitalised to its own risk profile. That makes this alignment structure materially more affordable to a first-time programme. The captive, its capitalisation and its regulatory approvals belong to the MGA and its advisers.
The economics
The spread between the last two rows is among the most important numbers in a cyber MGA business case. Same earnings, same book, different capacity structure, roughly double the valuation on these inputs. All figures are illustrative and based on a modelled year-five book that does not exist. For a real-world anchor, Munich Re agreed to buy At-Bay at about 2x gross written premium, and at well under half the valuation At-Bay carried in 2021.
Illustrative model, not a forecastTwenty-four months, with gates
Many cyber MGAs that stalled appear not to have picked the wrong strategy. They ran the right workstreams in the wrong order and spent the capacity budget before the evidence existed. Timings below are illustrative and will vary by programme, jurisdiction and capacity partner.
Run measured exposure against questionnaire underwriting on 40 to 60 live risks. Appoint a consulting actuary. Licence a catastrophe model. Draft the rating plan and the declination schedule.
Gate
A demonstrable pricing and bind-rate differential, plus a signed actuarial opinion on the rate level
Appoint a cyber reinsurance broker. Build the panel. Select and contract the fronting carrier. Negotiate the binding authority, the collateral and the claims authority.
Gate
Executed binding authority with at least $15m of capacity and a signed panel. Little downstream is worth funding before this
Cell formation with feasibility study and business plan. Policy administration implementation. Manuscript form drafting. Licensing in the first five states. Governance framework.
Gate
Cell licensed, system live in testing, five states licensed, governance manual approved by the capacity provider
Bind the first risks through founding channel partners and regional retail agents. Weekly peer review on every risk. Monthly bordereaux from policy one.
Gate
First 100 policies bound with complete control-evidence files and zero audit exceptions
Scale the channel and the licensed footprint. First binder renewal with a limit-increase request. First cell result. Build the competitor pricing dataset.
Gate
Loss ratio tracking below 50% on earned premium, binder renewed with expanded authority
When not to do this
None of these is an argument against the model. All four are arguments about order, and order is the thing most stalled programmes got wrong.
Astragar supplies the cyber risk intelligence an MGA can underwrite on: measured exposure, control evidence with provenance, financial quantification and a traceable record. The insurance business stays with you and your appointed partners.
Disclaimer
This is an illustrative technology-led MGA blueprint. Astragar is a cyber risk intelligence software provider. It does not underwrite insurance, bind coverage, supply capacity or act as an MGA formation adviser. Insurance, actuarial, legal and regulatory decisions remain with the relevant licensed and authorised parties.
Nothing on this page is an offer of insurance, an offer or solicitation of securities, or legal, regulatory, actuarial or investment advice, and it is not an offer to build, fund or operate an MGA. Market figures are sourced to the NAIC 2026 Report on the Cybersecurity Insurance Market, the Iowa Insurance Division release on House File 2766, and reported transaction terms, each as at November 2026. All factor ranges, limits, coverage positions, timings and valuation outputs are illustrative or modelled, are neither actuarially validated nor a forecast or guarantee of any outcome. Named carriers, reinsurers, brokers and platforms are referenced for market context only and their inclusion does not imply any relationship with or endorsement of Astragar. Capacity, licensing, captive and surplus lines structures are subject to regulatory approval in each relevant jurisdiction. Astragar does not display or rank carrier quotes.
See your cyber risk in $ terms, not CVSS scores.
