How Cyber Insurance MGAs Shape Policies for Evolving Cyber Risks

According to Diana Kelley, a CISO at Noma Security, cyber risk is well suited to the MGA model because risk evolves quickly and requires deep technical evaluation to understand exposure. MGAs write and administer policies on behalf of insurers, acting as intermediaries rather than as the insurer itself, with some even handling claims. They bring deep subject matter expertise to underwriting in areas like cybersecurity where there is limited actuarial data or standardization.

Cyber MGAs tend to work closer to the ground, with faster underwriting cycles, more up-to-date threat intelligence, and policies that reflect the risks CISOs are actually dealing with. They can reward mature, well-governed environments with broader coverage, more flexible terms, or more stable pricing, though they also add complexity for buyers.

The model shifts the insurance buying process away from pure CFO-driven transactions, as MGAs seek CISOs’ involvement to keep loss ratios down and to support expert underwriters and risk engineers in making well‑informed bets.