The Story
A different premise: the problem isn't a missing tool
Most organizations respond to cyber threats the same way each year - by buying another security tool. Resilience, a New York-based cyber insurance and risk-management company, was built on the argument that the gap isn't technology at all. It's the decision about which risks actually matter, measured in the only language a business already speaks: money.
Founded in 2016 as Arceo.ai by veterans of the U.S. military and intelligence communities, the company spent its early years building cyber analytics. In 2020 it made an unusual move - it became the insurer. Backed by Intact, it relaunched as Resilience, a managing general agent writing cyber and technology errors-and-omissions coverage for middle-market and large enterprises.
That shift is the whole strategy. When a company has to pay the claims, it underwrites differently. Resilience's software quantifies a client's exposure, its Risk Operations Center watches threat activity across the entire insured portfolio, and its in-house team handles claims and incident response when something goes wrong. The insurance, the analytics, and the response desk sit inside one system rather than three vendors.
The founding ethos is printed plainly on the company's own materials: "Your risk is our risk." It is an easy phrase to market and a harder one to structure. Resilience made it structural - it holds the coverage, runs the models, and answers the 2am phone call.
"Organizations don't need more security tools - they need better decisions."
- Resilience, on its founding rationale
The Business Model
Where the money and the incentives line up
Resilience operates as a managing general agent - it underwrites cyber and technology E&O policies on behalf of carrier and reinsurer capacity rather than carrying all the risk itself. Its primary capacity comes from Intact Insurance's underwriting companies, whose venture arm also led the company's largest financing round. Revenue is premium-linked, but the differentiator is the software and services layered on top.
That structure matters because it aligns incentives most cyber vendors cannot. A security tool vendor is paid whether or not a client is breached. A traditional insurer profits when it prices premium above claims. Resilience only wins durably if its insured clients actually avoid the largest losses - which is why prevention, monitoring, and quantification are core to the product rather than marketing gloss. The industry-leading loss ratio it reported in 2024 is the scoreboard for whether the model works.
The problems it solves are practical ones. Boards struggle to size cyber exposure, so they either over-invest in tools that don't move the needle or under-insure against the events that could sink them. Security teams lack a shared language with finance, so budget conversations stall. And when an incident hits, fragmented vendors slow the response. Resilience folds measurement, coverage, and response into a single relationship so those seams disappear.
Its expertise is concentrated where cybersecurity meets actuarial science: claims data feeding risk models, threat intelligence flowing into a portfolio-wide operations center, and underwriting shaped by what real incidents actually cost. The company's research arm, Threatonomics, publishes analysis on the economics of professionalized cybercrime - intelligence that loops back into how it prices and prevents risk.
