In 2016, Rotem Iram co-founded At-Bay with a bet so obvious in hindsight it seemed reckless at the time: the fastest way to make the internet safer for small businesses wasn't another security product - it was to make the people paying for the damage do something about it. If insurers had to absorb ransomware losses, insurers would have every reason in the world to prevent them. That idea became a $1.35 billion company.
At-Bay calls its approach "InsurSec" - a portmanteau Iram coined, a category he essentially built. It merges cyber insurance with active security technology: continuous monitoring, managed detection and response, vulnerability scanning, email security rankings. Customers don't just get a policy. They get a security partner that has a financial stake in their survival. The result is a claim rate that runs at less than half the industry average - and customers who experience 7x fewer ransomware incidents than the broader market.
Iram came to this idea through a career that zigzagged across national security, global consulting, and Silicon Valley in a way that would look improbable on paper. He started in Israel's Unit 8200 - the signals intelligence outfit regularly compared to the NSA - where he joined at 18 and was managing meaningful units by his early 20s. After his service, he studied computer engineering at Hebrew University, worked briefly as a software engineer at RAD Data Communication, and then headed to McKinsey, where he traveled the world advising major enterprises and quietly became more interested in the big problems than the engineering ones.
"I found that I was a lot less excited about engineering problems than I was about larger business problems."
- Rotem IramHarvard Business School followed, where he met his eventual co-founder Roman Itskovich. Both went back to work - Iram to K2 Intelligence, founded by Jules Kroll, where he ran the cyber practice as Managing Director and COO, advising Fortune 500s through breaches, building cyber defense strategies, sitting in on incident responses. In 2014, while deep in that work, he sent Roman a single email: "I think there's something in this cyber insurance thing."
They were both busy. Nothing happened for two years. Then a venture capitalist said four words that tipped the first domino: "I think you could be a really good CEO for a cyber insurance company." Iram took it seriously. At-Bay launched in late 2016 with $3.5 million in seed funding and two hypotheses: that technical security analysis could make cyber risks predictable enough to underwrite, and that insurers could stay engaged throughout the policy period to actually reduce those risks. Both proved out spectacularly.
By July 2021, At-Bay closed a $185 million Series D at a $1.35 billion valuation - joining a very short list of insurtech unicorns. The company had grown through a ransomware epidemic that caused most legacy carriers to pull back, raise rates dramatically, or exit the market entirely. At-Bay doubled down. Their underwriting data and active monitoring allowed them to maintain coverage while the rest of the market contracted. The bet paid off.
"While legacy insurers are pulling back on coverage and raising rates in the face of ransomware, At-Bay is doubling down with a modern approach to risk management that helps businesses improve their security and avoid loss before it happens."
- Rotem Iram, Series D announcement, 2021Iram's ambition doesn't stop at insurance. He's been arguing - including at Davos, where he represented At-Bay at the World Economic Forum - that the insurance industry is better positioned than any other institution to set cybersecurity standards. When a major software vendor ships a product with security disabled by default, it's not the IT departments of millions of small businesses that should bear the cost of enabling it. It's the software company. Insurance, he argues, can enforce that accountability through pricing pressure in a way that regulation alone cannot.
At-Bay has grown to 360 employees, maintains offices across the US, and has expanded its product suite well beyond a cyber insurance policy. Its MDR (Managed Detection and Response) product now covers endpoint, email, identity, and cloud. Its AI-powered Fraud Defense product has recovered more than $50 million in wire transfers for policyholders. Its InsurSec Rankings Reports - grading security vendors the way Yelp rates restaurants - are reshaping how brokers think about the relationship between policy terms and underlying security infrastructure.
Fortune named At-Bay to the Cyber 60 list for three consecutive years. The growth trajectory has been unusual even by Silicon Valley standards - not a consumer app or a developer tool, but an insurance-meets-security company that found its moat in a category nobody had previously defined.
Iram runs the company on a philosophy of deliberate delegation - a style he traces back to Unit 8200, where trust was built out of necessity. "The truth is, I trust my people more than I trust myself," he's said. "So I give them a lot of space to execute." It's a sentence that says something interesting about a person who has built one of the most technically specific companies in an industry not known for its technical specificity.