Coalition, a cyber insurance and security software provider, closed a $205 million Series E funding round that boosted its valuation to $3.5 billion.
The funding announcement comes just days after law enforcement and government agencies including the Department of Homeland Security, the National Security Agency, and the FBI issued a security alert warning organizations about escalating cyberattacks involving Conti ransomware. And it also signals investors willingness to back Coalition’s unique approach to cyber insurance and risk management.
Cyber insurance is Coalition’s main product, and as such, the provider has a financial incentive to help protect its 52,000 customers against cyberattacks, said CEO and co-founder Joshua Motta.
To this end, Coalition also provides a cyber risk management platform with several tools including risk assessment, automated security alerts, credential monitoring, endpoint detection and response (EDR), threat intelligence, security awareness training, patch management, distributed denial of service mitigation, penetration testing, and a security team that’s available to customers 24-7.
‘Insurance Companies Must Be Tech Companies’“We believe insurance companies of the future will have to natively be technology companies,” Motta said. “So what’s unique about our model is we provide a tremendous amount of software and data to our customers to help them prevent losses from happening.”
In the event that a company does experience a security breach, Coalition provides incident response services as well as insurance. This business model seems to be working for both Coalition and the companies that it insures.
“Our customers file one-third the frequency of claims compared to the U.S. cyber insurance market average,” Motta said. “And that’s precisely because we’re proactively helping protect them.”
The new investment also comes as Coalition recently crossed $325 million in run rate premiums, which represents an 800% increase over the prior year, according to the company.
Coalition Makes Risk Management Platform FreePreviously, Motta was an early employee at Cloudflare. He left that networking and security company to start Coalition, which launched in 2017.
“Leaving Cloudflare, one of the problems I saw was that cybersecurity is really expensive,” Motta said. Firewalls, anti-virus protection, EDR, and other technologies required to secure data and networks costs businesses a lot of money.
“But it’s also costly in a non-literal sense,” he said. These costs include security education, helping companies understand their own risks, and also how to use various cybersecurity tools in their own environments. “There’s over half a million open cybersecurity positions in the United States alone,” Motta said. “And that's really the problem we're trying to tackle: We're trying to democratize access to cybersecurity in the literal sense. We don't charge for it.”
Last month, Motta participated in a White House meeting convened by President Joe Biden. At the meeting, Motta along with C-suite execs from tech giants including Amazon, Microsoft, Google, IBM, and Apple discussed cybersecurity policy and pledged a combined investment of more than $30 billion to improve national security posture and jumpstart job training and education programs. Also at the meeting, Coalition announced it will provide its risk management platform, Coalition Control, at no cost to any business in the U.S.
Since the White House meeting, more than 10,000 organizations started using Coalition Control, Motta said.
Cyber Insurance Market ‘On Fire’The Series E funding brings Coalition’s total raised to $520 million. Durable Capital, T. Rowe Price Associates, and Whale Rock Capital co-led the round with participation from the company’s existing investors.
In addition to the amount raised, the timing is also significant because it comes as the cyber insurance industry faces an existential threat from ransomware.
Major insurers themselves have suffered losses from ransomware attacks. At the same time, the industry struggles with higher-than-ever insurance payouts to policy holders hit by ransomware and grapples with how to handle this growing risk. One insurer, AXA France, recently announced that moving forward, it won’t reimburse ransomware payments for new policy holders within the country.
“Ransomware in particular has emerged as the dominant cybercriminal business model, and cybercriminals have found a high-reward way in which to monetize their activities that that far exceeds stealing data or credit card numbers,” Motta said. “They realize that if they can hold your data or your business operations hostage, that can in many cases be worth millions even tens of millions of dollars, and as a result the severity of losses following cyber instances increased dramatically. This has posed a significant challenge for the cyber-insurance market.”
By the end of 2020 as cyberattacks and ransom demands skyrocketed, insurers realized that the premiums they charged were no longer high enough to cover their losses.
“The market was on fire, and loss ratios of many cyber insurance providers increased dramatically,” Motta said, adding that insurance companies did two things in response. “One, they increased rates on average 50% year over year. And, they also reduced coverage.”
This means that companies now pay 50% more for half of the coverage. “So it was really a 100% rate hike,” Motta said.
Coalition Insurance Coverage Doesn’t ChangePlus, some large insurers like AIG introduced co-insurance provisions and limited ransomware coverage. Additionally, many require their customers implement basic levels of cybersecurity controls such as multi-factor authentication or risk losing coverage.
However, because Coalition's platform helps customers identify and mitigate cyber risks, its customers experienced “dramatically fewer” ransomware attacks compared to the industry as a whole, Motta said. It continues to underwrite business exposure to ransomware without requiring coinsurance or any supplemental riders.
“We’ve not changed our coverage at all,” he added. “We continue to offer a full limit of coverage for ransomware, up to $15 million in coverage per entity. We’re in a very strong position and continue to offer what we believe is the most comprehensive solution at a very competitive price, despite some of the changes that have been happening.”