Coalition Startup Diligence Report
Proceed only to confirmatory diligence. The attractive thesis is a differentiated active-insurance platform in a growing cyber-insurance market; the gating questions are underwriting profitability, reinsurance/capacity resilience, defensible data/AI efficacy, efficient broker/partner distribution, regulatory/legal hygiene and current valuation/cap-table economics.
Coalition Startup Diligence Report
Coalition appears to be a scaled private unicorn operating at the intersection of cyber insurance, cybersecurity, data and AI. Public evidence verifies historical financings, broad product scope, carrier/licensing infrastructure, large policyholder/customer claims and a major Allianz partnership. Core investment diligence remains unresolved because audited financials, loss economics, current valuation, customer concentration, GTM efficiency, contracts, legal/regulatory files and technology validation are private.
Ransomware, BEC/FTF, cloud outages, AI-enabled attacks and systemic cyber events can create correlated losses.
Diligence request: Review underwriting guidelines, accumulation modeling, reinsurance treaties, claims triangles and stress tests.
At-Bay, Cowbell, Resilience and incumbents market overlapping cyber-insurance-plus-security propositions.
Diligence request: Request win/loss, renewal, pricing, competitive displacement and broker/customer reference evidence.
Active Data Graph, CoalitionAI and Wirespeed metrics are not independently validated in public materials.
Diligence request: Conduct technical diligence on model performance, telemetry, security controls, IP ownership and product reliability.
Strategic carrier relationships can accelerate growth but introduce approval, capacity, exclusivity and counterparty risk.
Diligence request: Review carrier contracts, reinsurance treaties, approval status, termination rights and concentration limits.
Coalition operates across insurance licensing, privacy/GLBA, scanning, claims data and AI workflows.
Diligence request: Counsel should verify licensing, regulator correspondence, privacy controls, data-rights inventory and AI governance.
Audited financials, cash/debt, loss ratio, gross margin, ARR, budget-to-actuals and projections were not public.
Diligence request: Require complete finance data room, actuarial pack and QoE review.
Aggregate policyholder counts are public, but top accounts, broker concentrations, churn, retention and revenue by customer are private.
Diligence request: Request customer cohort file, top 50 accounts, broker/channel production, churn and NRR/renewal data.
Public valuation anchors date to 2021/2022; current valuation, preferences and dilution are unknown.
Diligence request: Review financing documents, current cap table, preferences, debt, option pool and recent secondary/409A data.
Public evidence verifies major historical financings and a unicorn valuation anchor, but audited financials, current valuation, loss economics, cash/debt and projections remain private.
not publicly verifiable confidence: high
No audited annual or quarterly financial statements, management accounts, backlog, AR aging, product/geography gross profit, cash/debt or loss ratio data were public.
| Diligence item | Public status | Risk | Request |
|---|---|---|---|
| Audited financials and quarterly accounts | Not public | Cannot assess revenue quality, gross margin, cash burn or solvency. | Audited financials, monthly management accounts and QoE. |
| Premium, revenue and loss economics | Series E disclosed $325M run-rate premium; current loss ratio private. | Premium growth may not translate to underwriting profit. | Premium/revenue bridge, loss triangles, reserves and reinsurance economics. |
| Capital structure | Major rounds public; cap table private. | Preferences, option pool, debt or strategic rights could affect returns. | Cap table, charter, financing docs and 409A history. |
Financial conclusions are intentionally conservative because no private accounting materials were available.
not publicly verifiable confidence: high
No public forecast, budget, plan-vs-actual, valuation bridge or sensitivity model was located.
| Date | Event | Public metrics | Diligence implication |
|---|---|---|---|
| 2021-03-17 | Series D | $175M; $1.75B valuation; 42,000+ customers | Verify security rights, preferences and dilution from Series D. |
| 2021-09-28 | Series E | $205M; valuation more than $3.5B; 52,000+ customers; $325M run-rate premium | Reconcile valuation, premium run-rate and customer definition. |
| 2022-07-11 | Series F | $250M investment; 160,000+ SMBs in North America | Review post-money, preferences, strategic rights and current ownership. |
Current valuation beyond the verified historical $3.5B+ anchor was not independently verified in accessible public sources.
This chart is illustrative; do not interpret as continuous customer trend.
partially verified confidence: medium
Public sources identify major rounds and investors but not cap table, preferences, warrants, debt, option pool, pro forma ownership or current 409A.
not publicly verifiable confidence: medium
Tax, insurance reserves, reinsurance recoverables, regulatory capital, solvency filings, payables and related-party transactions were not public.
Coalition publicly markets an integrated active-insurance platform combining insurance products, Control, incident response, security training, Active Data Graph, CoalitionAI and Wirespeed ADR.
partially verified confidence: medium
Public pages verify a broad product suite and claims of risk reduction; diligence should verify attach, revenue mix, loss-ratio impact and technology efficacy.
| Product family | Public evidence | Primary diligence question |
|---|---|---|
| Insurance | Cyber insurance, technology E&O, AI coverage, executive risks and MPL appear in public navigation/products. | Revenue/premium mix, policy wording, loss ratio and attachment by product. |
| Risk platform | Coalition Control includes cyber health rating, attack surface monitoring, third-party risk and zero-day alerts. | Usage, engagement, attach, churn impact and claim-reduction causality. |
| Security/response | Wirespeed ADR, incident response and security awareness training are marketed in public navigation. | Revenue model, MDR/ADR performance, incident-response quality and integration costs. |
| Claim | Public support | Validation gap |
|---|---|---|
| Reduced claims frequency | 73% fewer claims than industry average. | Industry benchmark, denominator, time period and causality. |
| Claims outcomes | 64% of closed claims with no out-of-pocket loss; $21.8M recovered in 2026 report. | Closed-claim definition, claims severity mix and recovery methodology. |
| Control/data advantage | Control powered by claims data from 100,000+ policyholders. | Usage rates, alert efficacy and model performance. |
Company-published efficacy claims should be tested with actuarial and customer-reference diligence.
| Metric | Public value | Diligence implication |
|---|---|---|
| BEC/FTF share | 58% of claims | Demand driver but also frequency risk. |
| Ransom demand trend | +47% to average >$1M | Severity and accumulation stress. |
| Ransom refusal and recovery | 86% refused to pay; $21.8M recovered; 65% negotiation reduction | Claims capability value proposition; verify methodology. |
Company report metrics should be tested against raw claims data and actuarial analysis.
Architecture is inferred from public product pages, not internal architecture documents.
Coalition publishes large policyholder/customer counts and claims outcomes, but top customers, revenue concentration, churn, severed relationships and supplier economics are not public.
partially verified confidence: medium
Aggregate policyholder counts are public but customer names, revenue, industry/geography mix and concentration are not.
| Signal | Source/date | Interpretation |
|---|---|---|
| Customers | Series D, 2021-03-17 | Historical customer-scale anchor. |
| Customers | Series E, 2021-09-28 | Growth signal; reconcile with premium run-rate. |
| SMBs/policyholders | Series F and 2026 claims report | Large-scale claim but definitions/timing differ. |
Do not calculate precise growth without reconciling definitions.
All values are company-reported.
verified confidence: medium
Allianz partnership and carrier relationships are material public signals.
| Counterparty type | Public examples | Dependency question |
|---|---|---|
| Strategic carrier/global partner | Allianz Commercial / Allianz X | Approval status, exclusivity, economics, capacity and governance rights. |
| Carriers/capacity | Allianz, Arch, Ascot, Aspen, Chaucer, CIC, Lloyd’s, Fortegra, Zurich | Appointments, reinsurance, product approvals, termination rights and concentration. |
| Technology/data/security suppliers | Not fully disclosed publicly | Cloud, telemetry, data rights, security vendors and business-continuity risks. |
Carrier and reinsurer economics can be more material than traditional supplier spend.
Only the policyholder count is public; other stages require private funnel data.
not publicly verifiable confidence: high
Revenue by customer, premium by customer and customer cohort economics are not public.
not publicly verifiable confidence: medium
Public research did not identify severed customer or partner relationships.
partially verified confidence: medium
Carriers/reinsurers, broker channels, cloud/security vendors and data providers are likely critical suppliers, but supplier spend and contracts are private.
Coalition operates in a growing cyber-insurance market with direct venture-backed competitors and incumbent insurer/reinsurer competition.
verified confidence: high
Munich Re estimates strong market growth, while competitor sites show active-insurance/security convergence among At-Bay, Cowbell and Resilience.
| Company/group | Public positioning | Competitive pressure |
|---|---|---|
| Coalition | Active insurance and cybersecurity with Control, data graph, AI and ADR. | Must prove loss-reduction and integrated product value. |
| At-Bay | Cyber Insurance & MDR Security Platform; Stance MDR/security offerings. | Direct security-plus-insurance competition. |
| Cowbell | Adaptive Cyber Insurance with resiliency services, MDR, vendor risk and compliance offerings. | SMB/mid-market cyber-insurance competitor with risk services. |
| Resilience | Security posture, real-time threats and claims data with cyber insurance; risk quantification. | Enterprise-oriented cyber risk quantification and insurance overlap. |
Incumbent carriers and reinsurers also compete but were summarized at market level.
| Dimension | Coalition evidence | Risk if weak |
|---|---|---|
| Claims data and prevention | Control uses real-world claims data from 100,000+ policyholders; claims outcomes are advertised. | Product converges with broker/carrier offerings and pricing pressure rises. |
| Carrier capacity and reach | Allianz global strategic agreement and carrier table. | Capacity restrictions or partner conflict could impair growth. |
| Security operations and AI | Active Data Graph, CoalitionAI and Wirespeed ADR. | Claims reduction, underwriting advantage and security revenue thesis weaken. |
| Metric | Value | Implication |
|---|---|---|
| Global cyber insurance market 2024 | $15.3B | Large but still small relative to P&C, creating growth runway. |
| Global cyber insurance market 2025 | $16.3B expected | Near-term growth but also competitive attention. |
| North America 2024 | $10.6B; 69% share | Coalition’s North American footprint aligns with the largest market. |
Market size does not indicate Coalition market share or profitability.
Position values are qualitative and should not be treated as measured scores.
Coalition appears to distribute through brokers, carrier partnerships and digital/product-led channels; sales efficiency and budget data are private.
partially verified confidence: medium
Public pages point to broker-facing insurance navigation, carrier relationships and global strategic partnership rollout.
| Channel | Evidence | KPI to request |
|---|---|---|
| Broker channel | Homepage includes broker-facing navigation and insurance product pages. | Broker production, commission, conversion, quote-to-bind and retention. |
| Carrier/strategic partner | Allianz global agreement and listed carriers. | Partner-sourced premium/revenue, capacity utilization and termination/exclusivity terms. |
| Product-led risk engagement | Control alerts, data graph, security products and claims experience. | Active users, alerts acted upon, attach/upsell and loss impact. |
partially verified confidence: medium
Major-customer logos and revenue concentration were not public; aggregate policyholder counts are available.
not publicly verifiable confidence: high
New-business pipeline, conversion, quote-to-bind, renewal uplift and cohort data were not public.
| Metric | Public availability | Why it matters |
|---|---|---|
| CAC and payback | Not public | Insurance distribution can be commission- and partner-intensive. |
| Quota attainment and broker productivity | Not public | Determines scalable growth and channel concentration. |
| Marketing budget and channel ROI | Not public | Needed to understand contribution margin and growth efficiency. |
This table intentionally documents absence of public data rather than inferring performance.
not publicly verifiable confidence: high
Sales productivity, quota attainment, broker productivity and CAC/payback are not public.
not publicly verifiable confidence: high
Marketing budget, channel spend, broker incentives and brand spend are not public.
Coalition’s public R&D thesis centers on Active Data Graph, CoalitionAI and Wirespeed ADR, but R&D spend, architecture, data rights and model validation are private.
partially verified confidence: medium
Public sources describe a data and AI technical stack but not engineering org, budget, architecture controls, data lineage or IP chain.
| Asset | Public evidence | Diligence need |
|---|---|---|
| Active Data Graph | Internet-wide scans, honeypots, data leaks, AI/ML and claims/security research. | Data lineage, legal rights, model performance, false-positive rates and security controls. |
| CoalitionAI | LLM/GPT, Active Data Graph, trillions of data points, Security Copilot and Broker Copilot. | Model evaluation, privacy, guardrails, hallucination control and workflow ROI. |
| Control/underwriting integration | Control and incident-response integration with data graph. | Architecture, data flows, reliability, product analytics and security testing. |
This is an analyst abstraction from public pages, not internal documentation.
partially verified confidence: medium
CoalitionAI and Wirespeed ADR suggest an AI/security roadmap extending beyond insurance, but roadmap economics and integration status are not public.
| Initiative | Evidence | Open question |
|---|---|---|
| Wirespeed ADR | Acquisition and metrics around 1,801 ms median time to verdict and 99.99% alert-noise reduction. | Deal economics, product integration, metric methodology and revenue model. |
| AI workflows | CoalitionAI, Security Copilot and Broker Copilot use cases. | Adoption, accuracy, privacy controls and compliance reviews. |
| Control enhancements | Attack-surface, third-party risk, compliance and zero-day alerts. | Engagement, conversion and measurable risk reduction. |
Public pages identify founders/leadership and hiring activity, while Dealroom provides directional staff estimates; compensation, attrition and employee relations require private diligence.
partially verified confidence: medium
A full current org chart was not public; public leadership pages and hiring geography provide partial structure.
| Role/person | Evidence | Diligence ask |
|---|---|---|
| Joshua Motta | Co-founder and public leadership bio in company materials. | Employment agreement, equity, retention and references. |
| John Hering | Co-founder named in Series E founding statement. | Current role/equity and historical IP assignment. |
| Board/strategic investor rights | Allianz announcement includes increased equity/right to board nominee. | Board composition, investor rights, consent rights and conflicts. |
A complete roster should be requested because public bios are incomplete for diligence.
| Signal | Evidence | Diligence issue |
|---|---|---|
| Open roles | 18 open roles observed across US, Canada, UK, France and Australia; remote-first messaging. | Hiring plan, vacancy criticality and international employment compliance. |
| Staff estimate | Dealroom estimated 718 staff, 25 AI talent and 16 countries. | Actual headcount, contractors, attrition and functional mix. |
| Equity/compensation | No public option pool, compensation or attrition data. | Retention, dilution, payroll obligations and commission exposure. |
Careers data is point-in-time and should be rechecked near transaction close.
Reporting lines other than public founder/governance context are inferred functional groupings.
partially verified confidence: medium
Careers page and Dealroom estimate scaled staffing, but actual headcount by function/geography is private.
verified confidence: medium
Founder and leadership biographies are publicly available but should be supplemented with background checks and references.
not publicly verifiable confidence: high
Executive and employee compensation, bonus plans and commission plans are not public.
not publicly verifiable confidence: high
Option pool, grant schedule, vesting, refresh policy and equity overhang are not public.
not publicly verifiable confidence: medium
Public research did not include employee-relations, works council, union, claims or HR disputes.
not publicly verifiable confidence: high
Turnover, regretted attrition, offer acceptance, retention and performance-management data are not public.
Public legal pages disclose licensing, carrier relationships, privacy policy and disclaimers, but legal diligence needs contracts, dockets, IP chain, regulatory files and policy forms.
not publicly verifiable confidence: medium
No comprehensive public litigation docket review was performed and no litigation schedule was public.
| Area | Public evidence | Gap |
|---|---|---|
| Privacy/data | Privacy policy includes affiliates/subsidiaries and GLBA/global privacy references. | Data maps, DPIAs, incidents, vendor DPAs and AI governance. |
| Litigation/regulatory correspondence | No comprehensive public legal docket/regulator file in this pass. | Docket searches, complaints, regulatory exams and demand letters. |
| IP/contracts | Technology and Wirespeed claims create material IP/contract questions. | IP assignments, OSS review, acquisition documents, material contracts and carrier agreements. |
not publicly verifiable confidence: medium
Company-initiated litigation, recovery actions and IP enforcement activity were not publicly diligenced.
not publicly verifiable confidence: medium
Environmental/safety exposure appears less central for a digital insurer/security company, but workplace, data-center/vendor and insurance-regulatory matters need review.
| Topic | Public evidence | Private verification |
|---|---|---|
| Producer licensing | Coalition Insurance Solutions licensed in all 50 states and DC. | Regulator database checks, appointments, lapses and complaints. |
| Carrier relationships | Legal page lists Allianz, Arch, Ascot, Aspen, Chaucer, Coalition Insurance Company, Lloyd’s, Fortegra, Zurich and others. | Carrier contracts, capacity, reinsurance and product approvals. |
| Geographic product variation | Company disclaimer says policies/products may differ by geography and contracts control. | Policy forms, approvals, exclusions, claims authority and jurisdiction-specific terms. |
not publicly verifiable confidence: high
No patent/trademark/source-code/IP assignment diligence was completed in the public pass.
partially verified confidence: medium
Coalition discloses licensing and carrier relationships, but policy terms, producer appointments, E&O coverage and reinsurance remain private.
not publicly verifiable confidence: high
Carrier, reinsurance, broker, customer, cloud/security, Wirespeed acquisition and Allianz contracts are not public.
partially verified confidence: medium
Insurance licensing, privacy/GLBA, data scanning and AI features create regulatory diligence needs; correspondence was not public.
| ID | Claim | Status | Sources |
|---|---|---|---|
| EC-001 | Coalition is an active cyber insurance and cybersecurity company founded in 2017 by Joshua Motta and John Hering. | verified high | SRC-003SRC-005 |
| EC-002 | Coalition publicly announced major private financings: $175M Series D in 2021, $205M Series E in 2021 at more than $3.5B valuation, and $250M Series F in 2022. | verified high | SRC-002SRC-003SRC-004SRC-017 |
| EC-003 | Public research did not locate audited financial statements, quarterly accounts, cash/debt, loss ratio, reinsurance economics, ARR, gross margin or budget-to-actual data. | not publicly verifiable high | SRC-001SRC-002SRC-003SRC-016 |
| EC-004 | Coalition publicly offers a broad active-insurance and cybersecurity product suite across cyber insurance, technology E&O, AI coverage, executive risks, MPL, Control, Wirespeed ADR, incident response, security awareness training, Active Data Graph and CoalitionAI. | verified high | SRC-001SRC-006SRC-007SRC-009SRC-012 |
| EC-005 | Coalition claims differentiated cyber-insurance outcomes, including 73% fewer claims than industry average and 64% of closed claims with no out-of-pocket loss. | partially verified medium | SRC-006SRC-008 |
| EC-006 | Coalition Control is marketed as a cyber risk platform powered by real-world claims data from 100,000+ policyholders. | verified medium | SRC-007 |
| EC-007 | Coalition’s 2026 claims report cites material cyber-loss dynamics: BEC/FTF 58% of claims, average ransom demand over $1M after a 47% increase, 86% refused to pay and $21.8M recovered. | verified medium | SRC-008 |
| EC-008 | Coalition has publicly claimed large policyholder/customer scale, including 42,000 customers in Series D, 52,000+ customers in Series E, 160,000+ SMBs in Series F and 100K+ global policyholders in current claims materials. | partially verified medium | SRC-002SRC-003SRC-004SRC-008 |
| EC-009 | Allianz and Coalition announced a strategic global cyber-insurance partnership expansion, with Allianz transitioning commercial cyber insurance to Coalition and a minimum ten-year alignment, subject to approvals. | verified high | SRC-011 |
| EC-010 | Coalition Insurance Solutions discloses licensing in all 50 U.S. states and DC and lists carriers including Allianz, Arch, Ascot, Aspen, Chaucer, Coalition Insurance Company, Lloyd’s, Fortegra and Zurich. | verified medium | SRC-013 |
| EC-011 | Munich Re estimates the global cyber insurance market at $15.3B in 2024, $16.3B in 2025, North America at $10.6B and 69% share in 2024, with global premium volume expected to more than double by 2030. | verified high | SRC-018 |
| EC-012 | At-Bay, Cowbell and Resilience publicly market overlapping cyber-insurance plus security/risk-management propositions. | verified medium | SRC-019SRC-020SRC-021 |
| EC-013 | Coalition’s go-to-market appears broker- and partner-led with digital self-service and major carrier/channel relationships. | partially verified medium | SRC-001SRC-011SRC-013 |
| EC-014 | Public sources do not disclose Coalition sales productivity, marketing budget, broker commission economics, pipeline, CAC, payback, quota attainment or new-business cohort data. | not publicly verifiable high | SRC-001SRC-011 |
| EC-015 | Coalition’s Active Data Graph is described as an internet-scale data collection and analysis engine using scans, honeypots, data leaks, AI/ML and claims/security research. | verified medium | SRC-009 |
| EC-016 | CoalitionAI is marketed as using proprietary technology, LLM/GPT capabilities, the Active Data Graph and trillions of data points to generate AI alerts, Security Copilot and Broker Copilot use cases. | partially verified medium | SRC-012 |
| EC-017 | Coalition announced Wirespeed acquisition and advertised automated detection and response with a 1,801 ms median time to verdict and 99.99% alert-noise reduction. | partially verified medium | SRC-010SRC-001 |
| EC-018 | Coalition shows ongoing hiring and global remote-first operations, while Dealroom estimates 718 staff, 25 AI talent, 16 countries and 17 cap-table investors. | partially verified medium | SRC-015SRC-016 |
| EC-019 | Coalition’s privacy notice covers subsidiaries/affiliates, GLBA-related processing and global privacy jurisdiction disclosures. | verified medium | SRC-014 |
| EC-020 | Coalition legal disclaimers state products are offered through Coalition Insurance Solutions, coverages/products can vary by geography, and obligations are carrier-dependent with exclusions/limitations. | verified medium | SRC-001SRC-013 |
| EC-021 | Dealroom identifies Coalition as a San Francisco fintech/cyber-insurance unicorn founded in 2017 with directional estimates for staff, AI talent, countries and monthly visits. | partially verified medium | SRC-016 |
| EC-022 | The public unicorn-list record cites a Reuters-supported $3.5B Coalition valuation in September 2021, consistent with the Series E announcement. | verified medium | SRC-017SRC-003 |
| EC-023 | Top customers, revenue by customer, customer churn, severed relationships and supplier economics were not publicly disclosed. | not publicly verifiable high | SRC-001SRC-006SRC-008 |
| EC-024 | Public research did not identify litigation against/by Coalition, environmental or safety matters, IP assignments, material contracts, complaints or regulatory-agency correspondence sufficient for legal diligence. | not publicly verifiable medium | SRC-013SRC-014 |
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.