Written by: Agata Wojtas, Chief Commercial Officer, Digital Colliers
Munich Re's agreement to buy At-Bay for $575M is not a one-off. It's the clearest signal yet that cyber underwriting is consolidating around carriers with rich, continuous telemetry on the insured. If you run risk or security at a mid-market bank, your next renewal is going to feel less like a questionnaire and more like a data audit. The banks that treat it that way will pay less. The banks that don't will pay a premium, or get non-renewed.
What carriers are actually asking for now
The old renewal was a PDF questionnaire with yes/no boxes and a broker walking it through. The new renewal, especially from telemetry-native carriers, is a request for evidence. Expect questions like these, and expect them to be verifiable against your logs:
- A current control inventory mapped to a recognised framework, with owners and last-tested dates
- MFA coverage as a percentage, broken out by workforce, privileged accounts, third-party access, and legacy systems
- Your third-party vendor list with criticality tiers and the last assessment date for each
- Incident timelines from the last 24 months, including dwell time and mean time to contain
- Patch cadence for internet-facing assets and for anything touching cardholder or customer data
- EDR coverage as a percentage of endpoints, and how you handle the gaps
Carriers already know a lot of this from their own scanning. When your self-reported numbers don't match what their outside-in telemetry sees, that's the moment your premium moves the wrong way.
Why patching and MFA gaps hit hardest
Patching is where most mid-market banks quietly bleed. Industry data has long shown that only around 3 to 5 percent of publicly disclosed vulnerabilities get patched within 30 days. Carriers know this number. They price against it. If you can show a materially better patch cadence for internet-facing systems, with evidence, you get rewarded. If you can't, they assume you're at the industry baseline and price accordingly.
MFA is the other one. "We have MFA" is not an answer anymore. "We have MFA on 97 percent of workforce accounts, 100 percent of privileged accounts, and here are the seven exceptions with compensating controls" is an answer. The difference between those two answers, in premium terms, is real money.
Renewal is a data workflow, not a compliance dashboard
Here's the shift that separates the banks getting good renewals from the ones getting punished. The winners treat the renewal as a data workflow that runs continuously, not a project that spins up eight weeks before the policy expires.
That matters because most mid-market institutions cannot answer the questions above from a single source of truth. The same pattern that has FSN Research reporting month-end close at 8 to 10 days for mid-market finance teams, largely because they're still pulling numbers across systems by hand in spreadsheets, shows up in security and vendor risk. Control evidence lives in ten tools. Vendor lists live in procurement, legal, and IT with three different definitions of "critical." Incident data lives in the ticketing system and nobody has normalised it.
When renewal season hits, someone spends six weeks doing SQL by hand and screenshotting dashboards. The output is a compliance narrative, not verifiable data. Carriers can tell the difference.
The banks paying less have done three unglamorous things:
- Built a single control inventory that updates from the tools themselves, not from a spreadsheet someone edits quarterly
- Wired vendor risk, MFA coverage, and patch status into that same inventory so a single query answers the carrier's question
- Rehearsed the renewal pack quarterly, not annually, so the numbers they submit match what the carrier's scanners already see
The left-behind risk
DORA has been in force across the EU since 17 January 2025, and it's pushing the same underlying expectation from the regulator side: continuous, evidenced operational resilience, not annual attestations. Carriers and regulators are converging on the same demand. If your control data can only be produced by a heroic six-week effort, you're going to lose on both fronts.
The Munich Re and At-Bay deal is a preview. Over the next two renewal cycles, expect more of the market to move to telemetry-priced underwriting. The banks that can answer basic control questions in one report, from live data, will keep their premiums flat or lower. The ones that can't will fund everyone else's discount.