Coalition wants the claim that never happens

The construction company had done something right. When ransomware locked its files, its backups still worked. Employees could get back to work with little disruption. No ransom was necessary. Then came the second problem: the intruder had also stolen more than 60,000 documents. Restoring a computer does remarkably little to retrieve a secret.

01 The bill after the backup

In Coalition’s account of the incident, the compromised entry point was a virtual private network. One client was the Department of Defense, which meant exacting notification requirements and specialized legal work. Reviewing the stolen material cost $43,000. The company paid a $5,000 retention, its share before insurance; the policy covered another $106,000.

The episode explains Coalition better than a slogan could. A business can have working backups and still need forensic specialists, lawyers, notifications, and money. Cybersecurity has several jobs. Insurance has several more. Coalition tries to put the people doing those jobs within reach of one another before the telephone starts ringing.

02 An insurer with a reason to intervene

Joshua Motta and John Hering founded Coalition in 2017. Their background was in security and technology; Motta had worked at Cloudflare and the CIA. They knew the limits of selling another defensive tool to a company already struggling to manage the ones it owned.

Motta’s founding explanation laid out a sequence: sell insurance, invest in security tools for policyholders, then use the resulting data to improve both. Failure became information that could influence the next policy and the next warning. The insight was that complete technical protection would remain out of reach, while managing the financial consequences was possible.

“The real epiphany was this is a risk management problem.”Joshua Motta, Frontlines interview

That arrangement gives prevention an unusually direct commercial purpose. A security alert can avert a customer’s expensive interruption and an insured loss. The company selling protection has a reason to care whether the customer actually uses it. This is the logic behind Coalition’s name for the bundle: Active Insurance.

03 The policy becomes a working relationship

The practical front door is often an insurance broker. Businesses buy coverage through that familiar channel; their owners and IT teams can then use Coalition Control to examine security findings and decide what to fix. The platform watches external exposure, prioritizes weaknesses, and monitors third-party risks. Its newer Login Security feature connects to Microsoft or Google environments to watch for suspicious activity.

Control has a free version, with additional capabilities available through a subscription or qualifying insurance policy. Premiums require underwriting and a quote. The cost question is therefore specific: which coverage, retention, security services, and response arrangements does this particular business need? A free account and a paid insurance contract buy different things.

The 2025 US surplus-lines Active Cyber Policy makes behavior part of the bargain. Qualifying policyholders can receive lower funds-transfer-fraud retentions when they report within 72 hours of the fraudulent transfer. The reason is practical: quick reporting improves the chance of getting stolen money back. Other benefits reward eligible customers for addressing critical vulnerabilities.

The business combines insurance distribution, underwriting through its own carrier, and security services. Partner insurers supply additional capacity. That distinction matters when reading its growth figures: gross written premium measures the insurance business written, and should not be confused with Coalition’s revenue. The product spans several businesses because the customer’s loss spans several kinds of work.

Coalition also offers technology errors and omissions coverage and an executive-risk suite covering directors and officers, employment practices, fiduciary liability, and crime. Its expertise crosses underwriting, security research, digital forensics, and claims. These products share a useful premise: help a business understand an exposure while there is still time to change it.

04 A bigger stage, the same test

Building the combination required substantial capital. A $250 million Series F announced in July 2022 valued Coalition at $5 billion. That is a historical financing valuation. In November 2025, it acquired Wirespeed, adding automated detection and response technology to its security offering.

Then the distribution opportunity widened. In May 2026, Allianz and Coalition announced an expanded global commercial cyber partnership designed to run for at least ten years. The arrangement gives Coalition primary responsibility for pricing, product development, risk mitigation, and claims for the transitioning portfolio. July brought a US enterprise offering with up to $25 million in limits and a reported customer base above 110,000 policyholders.

Coalition occupies a crowded intersection. At-Bay and Cowbell also connect insurance and security. Its distinguishing proposition is the working combination of its risk platform, response capabilities, insurance relationships, and broker distribution. Buyers still have to compare the actual contract and services.

05 A useful habit to borrow

The 2026 claims report says 64% of closed claims involved no out-of-pocket loss for the policyholder. It is an encouraging reported outcome, although claims data alone cannot establish which part of the model caused it. Selection, policy terms, and customer behavior all matter.

The borrowable idea is straightforward: give somebody responsibility for the interval between buying protection and needing it. Assign security findings, verify fixes, and establish who calls the bank or response team. An alert without an owner cannot do much. Coalition also says external monitoring is not a penetration test; internal defenses and policy limits remain consequential.

Inside the company, that shared responsibility has a cultural counterpart. Coalition describes itself as remote-first and says its founders wrote its values before the business plan. Humility and responsibility feature prominently. For a company bringing insurance specialists and engineers into one organization, asking who owns the next step is useful internal discipline, too.

For a business choosing insurance, that changes the conversation. Alongside the premium and exclusions, ask what happens during an ordinary Tuesday. Who notices the weakness? Who explains the fix? Who helps when it becomes an incident? Coalition’s promise becomes useful precisely where those questions acquire names, deadlines, and actions.