More Than an MGA: How Coalition Transcends the Legacy Label

When presented with a wide variety of options, it’s human nature to narrow the options by category. We do it because it makes choice feel easier.

Should I make dinner at home or dine out? Should I stay at a hotel or rent a house?

Grouping choices into familiar buckets helps us navigate complexity, but it also creates artificial trade-offs. We choose a category, accept its implicit limits, and rule out everything else before we even look at the individual options.

This same dynamic plays out in cyber insurance with traditional carriers and managing general agents (MGAs). Justified or not, the carrier label signals scale and permanence, while the MGA label signals agility but with borrowed authority and temporary backing. Brokers and buyers often default to a category upfront, assuming no single partner can offer both.

Coalition was engineered from day one to break the binary model in cyber insurance. Our approach has always been different — built not to fit in a category, but to transcend the MGA label.

1. Real skin in the game

The most common critique of standard MGAs is that they operate as pure pass-throughs, earning fees while offloading 100% of the risk onto external balance sheets. When an MGA has no financial skin in the game, its incentives can naturally diverge from those of its clients and capacity providers.

Coalition operates with direct risk on the line. In 2026, we expect to place more than $115 million of premium on our balance sheet through Coalition Insurance Company, admitted in all 50 states and the District of Columbia. 

When an MGA has no financial skin in the game, its incentives can naturally diverge from those of its clients and capacity providers.

We also participate meaningfully on a portion of the business we write on carrier partner paper through our Hawaii-domiciled captive, Palekana Insurance, Inc., and in 2026 expect Palekana to reinsure $52 million of that premium. That means our economics move with the loss ratio, helping align our financial interests with those of our carrier partners. When our underwriters price a risk, we’re pricing it for our own book as well as our carrier partners’ books.

2. Capacity built to last

The concern behind the MGA model is capacity being temporary: a capacity provider gets nervous after a bad quarter, the facility shrinks, and a broker is stuck re-marketing an account they placed 12 months ago.

Coalition's company paper agreements are structured for continuity. In most cases, Coalition’s arrangements with capacity providers are perpetual with multi-year cancellation clauses and currently do not have capacity restrictions. Our partnership with Allianz is set to run for a minimum of 10 years. Our capacity providers are highly rated, and they’re committed because the arrangement is mutually beneficial: We get capital, and they get access to our cyber expertise and focus, not just distribution.

3. Authority, not intermediation

A middleman MGA passes questions along. Coalition owns the functions that decide outcomes: underwriting, pricing, product and policy language, risk mitigation, and typically claims management.* We hold delegated underwriting, pricing, and claims authority, which means we can make decisions at our own discretion within that delegated authority.*

Coalition’s underwriting authority exists because of what sits behind it. Our policy language, underwriting models, and risk management capabilities are built on a data and technology platform our capacity providers can’t readily replicate internally, and it’s the basis for the autonomy they extend to us.

A middleman MGA passes questions along. Coalition owns the functions that decide outcomes.

For brokers, the practical effect is a shorter path from question to answer and a consistent approach to decision making. For risk managers, it means the entity explaining the coverage is the exact same entity that wrote it and typically will adjust the claim.

4. Value when claims hit

The true test of a cyber insurance provider (MGA or otherwise) isn't how smoothly a policy binds, but what happens when a crisis hits and an organization's operations are on the line.

Coalition handled more than 4,000 claims in 2025, and 64% of closed claims were resolved with no out-of-pocket financial loss to the policyholder. This performance is a direct result of capabilities that rarely exist inside a traditional carrier or MGA.

When funds transfer fraud occurs, Coalition’s claims team works closely with law enforcement and financial institutions to freeze and recover stolen wire transfers. To date, we’ve successfully helped recover more than $158 million in stolen funds on policyholders’ behalf.

When ransomware strikes, Coalition can enlist Coalition Incident Response (CIR), our affiliated digital forensics and incident response firm. By integrating triage, containment, and claims handling under one roof, we help eliminate handoff friction, contain operational downtime, and support timely claims resolution.

5. Integrated security expertise

None of these claims outcomes are possible for an MGA whose role ends at binding. Risk mitigation is built directly into our approach, and policyholders receive access to continuous security tooling, such as:

• Coalition Control® for continuous risk monitoring and attack surface management

• Login Security to detect suspicious activity and contain identity-based threats

• Zero-Day Alerts that notify policyholders about critical and time-sensitive vulnerabilities

Waiting for a breach to occur and settling a financial loss months later is a passive model that fundamentally fails.

Beyond the insurance policy, Coalition offers Wirespeed, which transforms the legacy approach to detection and response by identifying, isolating, and containing digital threats with lightning-fast speed and laser precision.

Waiting for a breach to occur and settling a financial loss months later is a passive model that fundamentally fails. By continually assessing risk throughout the policy lifecycle, we help policyholders spot and stop cyber threats by offering a unified experience.

6. Engineered for the long haul

Coalition is independently run and well-capitalized. We’ve raised more than $755 million from top-tier investors, like Allianz X, General Atlantic, and Ribbit Capital, and have grown responsibly with a focus on long-term sustainability.

In cyber insurance, this matters. Losses develop over years, and the entity that priced the book should still be there when they do. Our capital base, our risk-taking on our own balance sheet, and the structure of our capacity agreements are all built on the understanding that we’re here for the long haul, not a near-term exit.

Breaking the binary in cyber insurance

When you look past legacy labels, the choice isn't between the balance sheet weight of a traditional carrier or the agility of an MGA.

The true measure of an insurance provider comes down to alignment, authority, and execution: whether they hold skin in the game, whether their decision-makers sit across the table, and whether they possess the structural stability to stand behind their promises across market cycles.

Coalition was engineered from the ground up to unite these strengths into a single, cohesive model. By combining real balance sheet retention, decade-long capacity, delegated operational authority, and native security defense, we deliver an end-to-end cyber risk partner who’s built to lead and built to last.

*Claims authority depends on and varies by program and jurisdiction.

This blog post is designed to provide general information on the topic presented and is not intended to constitute or render legal or other professional services of any kind. If legal or other professional services are required, the services of a professional should be sought. Descriptions of coverage are for general informational purposes only and are subject to the terms and conditions, including the limitations and exclusions, of the applicable policy. The reader is cautioned to consult independent professional advisors and formulate independent conclusions and opinions regarding the subject matter discussed herein. Coalition makes no representations as to the accuracy or completeness of this content. Any action taken based on this information is at the sole discretion and risk of the reader. Coalition and its affiliates expressly disclaim any liability for losses or damages resulting from the use of or reliance on this information, which is used strictly at the reader’s own risk. 

Insurance products are offered in the U.S. by Coalition Insurance Solutions, Inc., a licensed insurance producer and surplus lines broker (Cal. license # 0L76155) acting on behalf of a number of unaffiliated insurance companies, and on an admitted basis through Coalition Insurance Company, a licensed insurance underwriter (NAIC # 29530), or Allianz Global Risks US Insurance Company and its affiliate Fireman’s Fund Indemnity Corporation (“AGRUS”) as an insurance intermediary and agent of AGRUS. See licenses and disclaimers.

Coalition Incident Response, Inc. dba Coalition Security, an affiliate of Coalition, Inc., provides security products and services globally.  Coalition Security does not provide insurance products. Security products and services may not be available in all countries and jurisdictions and may require separate payment.Copyright © 2026. All rights reserved. Coalition and the Coalition logo are trademarks of Coalition, Inc. Coalition is the marketing name for the global operations of affiliates of Coalition, Inc.