Shieldmoss — MGA киберстрахования для малого бизнеса в Великобритании, продажа через брокеров

Real comparables: Coalition (Active Cyber Insurance, an appointed representative of an FCA-authorised MGA platform, with Allianz and Lloyd's capacity), At-Bay, Cowbell, CFC Underwriting, Hiscox CyberClear and Beazley's MGA-supported programmes; Resilience in mid-market.

How to read the model — whose combined ratio. An MGA writes the policy but does not pay the claims: the risk sits with the capacity provider (a Lloyd's syndicate) and its reinsurers. The programme's combined ratio is roughly 55% loss ratio + 32% acquisition costs (the MGA's commission, from which it pays the broker) + about 5% insurer expenses ≈ 92%. The MGA's business model is to keep that loss ratio low — if it creeps above about 65%, capacity is withdrawn at renewal or the commission is cut. The MGA earns three things: its net commission (32% minus the broker's 17.5%), a profit commission when the loss ratio beats target, and the security-services subscription. UK Insurance Premium Tax (12%) is charged on top of the premium and passed to HMRC by the insurer, so all amounts below are net of IPT.

Who pays

UK businesses with £1–50M turnover — professional services, healthcare clinics, manufacturers, retailers and charities — buying through their commercial insurance broker, who chooses which MGA's product to put in front of the client. The capacity provider pays the MGA's commission out of the premium; the client pays the premium and, optionally, the monitoring subscription.

How it makes money

At 1.28 dollars per pound. Average premium about £1,500 a year (≈ $1,920, or $160 a month earned). The capacity provider pays the MGA a 32% commission ($51.20 a month); 17.5 points go straight to the broker ($28), so the model books only the MGA's own 14.5% — about $23 per policy a month. A profit commission of about 2% of premium ($3.20) is accrued from year 2 when the first underwriting years mature. About 15% of clients take the MDR add-on at about £47 ($60) a month — $9 per policy on average, of which 55% is paid to the security partner. Claims are paid by the carrier, and so are the incident-response and legal panel fees; the MGA's own cost is notification, triage and panel coordination — about $1.50 per policy a month plus the incident-response coordinators in the team.

Key assumptions

• Average SME cyber premium of about £1,500 a year for £250K–£1M limits — consistent with UK small-business cyber pricing after the 2022–2023 hardening and the softening since; larger mid-market clients pay £5–20K and are a minority.
• Commission: MGAs typically receive 30–35% of gross premium as acquisition costs from capacity providers and pay brokers 15–20% of it; the model uses 32% and 17.5%. Profit commission of about 2% of premium is booked from month 13, only if the book runs near a 55% loss ratio.
• Retention: annual policies; about 2% of a cohort cancels mid-term (business sold or closed), about 85% renew — the model shows 83% at month 13 and 1.3% a month after. 97.8% at month 12 is above the typical B2B range: a policy is paid for the year, so 'churn' only happens at renewal. Clients who fix the vulnerabilities flagged in the scan renew more often.
• Acquisition: brokers are recruited by business-development managers in the team; the channel cost of about $180 per bound policy covers broker events, portal incentives, travel and the BDMs' bonuses. Broker panels need 3–4 months from agency agreement to first quotes, so agencies join in waves (months 3, 7, 11 after launch, consolidators from month 16). Of submissions, about 80% get a quote (the rest fail the scan or are out of appetite) and 22% of quotes bind — a median broker-market hit rate. Direct online selling to micro-businesses was tested and dropped: at about $18 a click for 'cyber insurance for small business' a direct policy costs about $1,900 to acquire — more than twice its lifetime value; UK SMEs buy commercial cover from brokers.
• Scanning data and threat-intelligence feeds about $2.50 per policy a month; underwriting platform and rating engine licence $8,000 a month.
• London salaries: cyber underwriter about $8,500 a month (≈ £80K a year), security engineer $8,000, broker BDM $6,000 base; employer NI and pension about 18%.
• Revenue is booked net of the broker's share, and the team grows with the book — underwriters, security engineers, incident-response coordinators, broker account managers and bordereaux analysts are added as premium grows. Initial cash of $4.6M reflects that an MGA must fund two years of underwriting team and broker build-out before the book renews; a scaled MGA with automated SME underwriting earns a high margin, but it depends on the profit commission and on capacity staying in place.

Risks

• Capacity withdrawal: one bad ransomware year (2020–2021 saw loss ratios above 100% in cyber) and the syndicate cuts capacity — the MGA can lose its product overnight. Diversify across two capacity providers.
• Systemic event: a widespread vulnerability (MOVEit, CrowdStrike-type outage) hits thousands of policies at once; the MGA does not pay claims, but its profit commission disappears and pricing must rise.
• Broker power: brokers can move a whole book to a competitor that pays 20% commission instead of 17.5%; a third of new business can sit with one or two consolidators.
• Price competition: the cyber market softened in 2024–2026 as capacity grew; premiums per policy can fall 10–15% a year while exposure grows.

How to adapt this model

• For the US (Coalition, At-Bay, Cowbell): the average small-business premium is higher (about $2,000–3,000), broker commissions about 15%, no IPT but state surplus-lines taxes of 3–5% paid by the client; salaries 1.4× London.
• If you are the insurer, not an MGA: replace commission with earned premium, add claims at 55% of premium plus capital cost and reinsurance; revenue per policy rises six-fold but the result becomes volatile.
• For a security-first model (the subscription is the core and insurance the add-on): raise the MDR attach rate and price, and give the insurance commission a smaller share of revenue.
• To stress-test, drop the profit commission to zero and cut the average premium by 15% — check that the MGA stays profitable by year 4.

Sources

• Coalition UK — Active Cyber Insurance, Coalition Control, broker distribution, appointed representative of Davies MGA Services (FCA 597301), Allianz/Lloyd's capacity: https://www.coalitioninc.com/en-gb
• UK Insurance Premium Tax standard rate 12%: https://www.gov.uk/guidance/insurance-premium-tax
• Average premium, commission split (32%/17.5%), profit commission, renewal rate and CPCs — author's estimates from UK London-market practice