What problem does it solve?
A small business cyber submission that waits for an underwriter delays the broker's answer, and At-Bay says its Mailbot quotes small accounts automatically, which frees its underwriters for more sophisticated work. The usual alternative, a long questionnaire, is slow for the applicant, and Coalition says its scan based reports shorten lengthy questionnaires and cut the quoting process time in half. A questionnaire also depends on the applicant's own answers about controls such as patching, multi factor authentication and backups.
The risk also moves. Coalition reports that cyber claim costs for small businesses rose 56% to an average of $149,000 in the year before its 2022 post, and At-Bay's chief technology officer says assessing risk cannot be done once, nor by asking questions or running a vulnerability scan. Insurers that sell through brokers and platforms therefore try to replace the questionnaire with outside in data on each applicant, score it with a model, and keep underwriters for the accounts that need judgment.
This page covers the automated decision itself. Preparing a file for a human underwriter is covered by submission triage, and drafting the risk narrative by the underwriting copilot.
- Coalition says cyber claims costs for small businesses increased 56% to an average of $149,000 in the year before its 2022 post, and that the average ransom demand made to its policyholders rose more than 20% to $1.8 million.Empowering Brokers with Active Risk Assessment (2022)
- At-Bay says that over three years of assessing email providers it found that customers of Microsoft 365 are twice as likely to experience a claim as customers of Google Workspace.New Threats, New Tech: How Innovation Is Redefining Cyber Risk (2025)
How does it work?
- Take a short application. The broker or a partner platform submits a short application through a portal or an API. Coalition says its scanning lets it drop many questions, and At-Bay's API takes a short set of questions.
- Scan the outside. The insurer scans the applicant's internet facing systems the way an attacker would, enumerates its technology and checks it against vulnerability and dark web data. Coalition compares the footprint with its own incident response and claims data to build a personalized risk score.
- Score and price. A model prices the risk. Rules sort the quote into automatic or referred: At-Bay quotes automatically up to $100 million in revenue and refers larger clients to an underwriter. Coalition describes heuristics that decide which quotes a human reviews.
- Issue a bindable quote. Eligible applicants receive quotes in seconds or minutes, which the broker can bind. Small accounts can also arrive by email, where a bot reads the submission and replies with a quote, as At-Bay describes.
- Refer what the model should not decide. Underwriters price the referred risks. In Coalition's active learning design a quote may be escalated to a human reviewer when the model price falls outside an acceptable range, and the experts' price adjustments are used to train the model.
- Keep watching after binding. Coalition says it continues assessments and alerting throughout the policy period, and Cowbell says its closed loop approach bundles continuous risk assessment with pre and post breach risk improvement services.
- Audience
- Back office
- Autonomy
- Supervised agent
- Adoption
- Early adopters
- Channels
- API and system to system, Email, Internal tools
What is it worth?
Benchmarks are computed from the public deployments below: one data point per organization per KPI, with who made each claim.
| KPI | Median | Reported range | Data points | Claimed by |
|---|---|---|---|---|
| Cycle time | Not pooled | Not pooled: up to 5 minutes, up to 2 minutes | 0plus 2 up to | 2 organization |
| Cycle time reduction | Too few to pool | 50% | 1 | 1 organization |
Value drivers: Speed and cycle time, Lower cost to serve, Revenue growth, Risk and loss reduction.
Indicative value
A cyber insurer receiving 20,000 small business submissions a year
USD 200,000 to USD 1.2 million
Underwriting capacity released per year
How this is calculated
Formula: submissions * autoShare * minutesPerSubmission / 60 * costPerHour. The low scenario uses every low input, the high scenario every high input.
| Input | Low | High | Basis |
|---|---|---|---|
| Small business submissions per year submissions, submissions per year | 20,000 | 20,000 | The reference insurer. |
| Share of submissions quoted without an underwriter autoShare, fraction of submissions | 0.5 | 0.8 | Editorial assumption. At-Bay says its platform gives automatic quotes for most API submissions (https://www.at-bay.com/about/partnerships/). Measure on your own appetite. |
| Underwriter time per small business submission today minutesPerSubmission, minutes per submission | 20 | 45 | Editorial assumption. Replace with a time study of your own small business desk. |
| Fully loaded cost of an underwriting hour costPerHour, USD per hour | 60 | 100 | Editorial assumption. Replace with your own fully loaded cost. |
What it leaves out: Capacity released, not cash saved, unless headcount changes. It leaves out the larger effects of quoting faster (more business bound) and of selecting risk better, the loss experience of automatically quoted accounts, and the cost of scanning data, models and integration.
Who already uses it?
3 public deployments, strongest evidence first. Grades: A regulator or audit, B the organization itself, C vendor case study, D anonymous or estimate.
At-Bay
United States · Insurance · 2025
At-Bay, a cyber insurer, assesses applicants with scanning data and machine learning and issues bindable cyber, tech E&O and miscellaneous professional liability quotes automatically, through its broker platform and an API for partner platforms. Its API page says applicants up to $100 million in revenue are eligible for automatic quotes while larger clients are quotable with underwriter approval, and that its underwriting team receives referrals and complex submissions. Its chief technology officer says At-Bay uses AI to automate risk decisions and quoting with minimal human touch for smaller businesses, including a bot that reads emailed submissions and quotes small accounts.
- Cycle time: up to 2 minutes, per quote, businesses up to $100M in revenue
"Generate quotes in less than 2 minutes for businesses up to $100M in revenue."
Claimed by: organization
Coalition
United States · Insurance · 2022
Coalition, a cyber insurer, scans an applicant's external footprint when a broker submits a quote and uses the result to remove questions from the application and to build a risk score. Its own technical post describes how quotes that pass heuristics are priced by an automated production model while flagged quotes go to cybersecurity and insurance experts, whose price adjustments are fed back to improve the model (active learning).
At the UK launch in 2022 Tom Draper, Head of Insurance, UK, said the company offers brokers the ability to quote and bind in seconds. Its Active Risk Assessment page says the reports shorten lengthy questionnaires for brokers while cutting quoting process time in half. Coalition publishes no share of quotes priced without review.
- Cycle time reduction: 50%, quoting process time for brokers using Active Risk Assessment reports
"For brokers, the reports shorten lengthy questionnaires and improve accuracy in underwriting cyber and executive risks — while cutting quoting process time in half."
Claimed by: organization
Cowbell
United States · Insurance · 2021
Cowbell, a cyber insurer for small and mid sized enterprises, describes in its March 2021 Series A announcement an AI based approach to risk selection and pricing. It calls Cowbell Factors its continuous risk assessment services, says it has a risk pool of 10 million continuously monitored organizations, and says its continuous underwriting platform compresses the insurance process from submission to issue to less than 5 minutes. The figures are the company's own and no independent measure is given.
- Cycle time: up to 5 minutes, submission to issue
"In its unique AI-based approach to risk selection and pricing, Cowbell’s continuous underwriting platform, powered by Cowbell Factors, compresses the insurance process from submission to issue to less than 5 minutes."
Claimed by: organization
How do you implement it?
A model agnostic playbook: what to prepare, the order to build in, and what goes wrong.
Data you need
- At least a few years of cyber claims with the applicant's technology profile at the time of binding
- Scanning and threat data covering the applicant's domains, cloud and remote access exposure
- Written appetite and referral rules per class and revenue band
- A labelled record of which quotes underwriters changed and by how much
Systems to integrate
- Broker portal and partner API for application and quote
- Scanning and threat intelligence data sources
- Rating engine and policy administration system that can bind and issue automatically
- Underwriting workbench for referrals and corrections
- Email intake for small accounts
Complexity: High
The decision engine needs an outside in data pipeline that scans applicants and a pricing model trained on the insurer's own claims, so the loss history is the limiting input. Around those sit appetite and referral rules the actuaries and underwriting management sign off, a broker portal or API, and a policy system that can bind and issue without manual steps. An incumbent has to plan for the policy administration and distribution integration as well as the model.
- 1
Start with the narrow band the model can learn
Pick revenue and class bands where you have claims history, such as technology firms under a revenue limit, and quote only those automatically at first. Refer everything else.
- 2
Replace questions with data, one question at a time
For each questionnaire item, test whether a scan or an external data point answers it as well. Remove the question only when the data agrees with the answer on a sample of past applicants.
- 3
Build the human review loop first
Define which quotes go to an underwriter, record the price the human sets, and use the difference to improve the model, as Coalition describes with active learning.
- 4
Back test before binding anything
Score a year of past submissions, compare the model's price and referral decision with what underwriters did, and look at the segments where the two disagree most.
- 5
Release in stages with a loss watch
Move from shadow mode, to automatic quotes that underwriters sample, to bindable quotes in one channel. Track claims frequency of the automatic group against the referred group.
- 6
Plan the policy period work
Decide what happens when a scan finds a new exposure after binding: an alert to the insured, a remediation offer, or a referral at renewal.
Guardrails
- Hard appetite limits (class, revenue, limits) enforced in rules outside the model
- Automatic quotes capped at a policy limit and revenue band until loss experience is proven
- Scanning limited to passive, publicly visible information, with the legal basis checked per country
- Every quote stores the data, model version and rules that produced it
- Pricing models tested for unfair discrimination between segments before release
KPIs to instrument
- Share of in appetite submissions quoted automatically, and share bound
- Time from submission to bindable quote, by channel
- Loss ratio of automatic quotes versus referred quotes
- Share of automatic quotes that an underwriter later changes, and by how much
- Questions removed from the application and the applicant drop off rate
Human in the loop
Underwriters price and decide the referred risks, review a weekly sample of automatic quotes, and own the appetite and referral rules. Actuaries sign off model changes, and a person approves any change that widens the revenue band or limits that are quoted automatically.
Common failure modes
- Scan data read as a verdict
- An external scan sees what is exposed, not what is controlled inside. A model that treats a missed finding as safe misprices the applicants whose controls the scan cannot see. Keep questions that scans cannot answer.
- Adverse selection in the automatic band
- Fast, cheap quotes attract the applicants who expect to need them. Watch the loss ratio of the automatic group separately from the rest of the book.
- Model drift as attackers change
- Claims in cyber move quickly, and a model trained on last year's losses prices the wrong signals. Retrain on a schedule and track how often underwriters override the model.
- Aggregation risk hidden by speed
- Thousands of small policies that share one cloud provider or software product form one large exposure. Measure accumulation across the automatically written book, not per policy.
What are the risks and rules?
EU AI Act
Depends on design
Annex III point 5(c) covers risk assessment and pricing of natural persons in life and health insurance. Underwriting of business cyber insurance is not listed, so the quote decision itself carries no high risk duties. The tier would change if the same engine were used to price life or health cover for individuals. Where an email or chat agent replies to brokers or applicants who are natural persons, the transparency duty of Article 50 applies unless it is obvious from the context that they are dealing with AI.
Guidance
- Opinion on Artificial Intelligence governance and risk management (European Insurance and Occupational Pensions Authority, Europe). Clarifies how existing insurance legislation, including Solvency II and the Insurance Distribution Directive, applies to insurance AI systems that are neither prohibited nor high risk under the AI Act. It is addressed to national supervisors.
- Annex III, high risk AI systems referred to in Article 6(2) (European Union, Europe). Point 5(c) names life and health insurance risk assessment and pricing of natural persons; business cyber underwriting is outside it.
Controls to put in place
- AI inventory entry per model with an accountable underwriting and actuarial owner
- Model documentation, back test results and sign off for every release
- Versioned appetite, referral and limit rules
- Audit trail from each quote to the scan data, model and rules used
- Periodic review of override rates, loss ratio by channel and accumulation
- Legal review of scanning practices per jurisdiction, and a way for an applicant to see and correct scan findings
Frequently asked questions
- How fast can an automated cyber quote be?
At-Bay says its API generates quotes in less than 2 minutes for businesses up to $100M in revenue, and Cowbell says its platform compresses the process from submission to issue to less than 5 minutes. Both figures come from the insurers' own pages.
- Are all small business cyber quotes automatic?
No. At-Bay says its platform gives automatic quotes for most API submissions and that its underwriting team handles referrals and more complex submissions. Coalition describes heuristics that decide which quotes a human reviews, and says a quote may be escalated to a human reviewer when the model price falls outside an acceptable range.
- Is the scan more reliable than the questionnaire?
It sees different things. Coalition says its scanning removes many questions because it can identify, for example, a company's industry and the number of its machines connected to the internet, while At-Bay's technology chief says risk cannot be assessed only by asking questions or running a scan. Insurers use both and add claims data.
- Is automated business cyber underwriting high risk under the EU AI Act?
Business cyber underwriting is not on the Annex III list, which names life and health insurance for natural persons. Existing insurance rules on governance, data quality and fair treatment still apply, as EIOPA's opinion on AI governance sets out.
How to cite this page
Blits.ai AI Use Case Library, "AI straight through underwriting for small business cyber insurance", last verified 13 October 2026, https://www.blits.ai/ai-use-cases/straight-through-small-business-cyber-underwriting. Licensed under CC BY 4.0. Method: how we verify use cases.
Changelog
- 13 October 2026: First published