“We had to accept reality”: At-Bay CEO on the $575 million Munich Re sale
Rotem Iram says the company’s $1.35 billion valuation became impossible to sustain after interest rates rose and cyber insurance prices fell, forcing At-Bay to expand into cybersecurity and eventually sell.
“There is something about entrepreneurship that resembles the work of a farmer,” says Rotem Iram, founder and CEO of cyber insurance company At-Bay. “You have to work hard, but you also need rain. And in our case, suddenly, a drought set in. In 2021, the financial landscape began to shift dramatically. Interest rates rose, valuation multiples plummeted, and we needed to grow tenfold just to maintain our previous valuation. It’s incredibly tough. You’re constantly fighting a battle because the drought just won’t let up. You look at your team and see the scars and scrapes because the constant struggle takes its toll. You look around and see companies falling apart and disappearing left and right. So, we had to accept reality as it was and move toward a sale. And yes, there’s a sense of relief now.”
In August, At-Bay was sold to German insurance giant Munich Re for $575 million. It sounds like a dream outcome, yet just five years earlier, the company had raised funds at a valuation of $1.35 billion. Those were the days of the tech bubble, which has since burst spectacularly. Consequently, an exit of this magnitude for a company that raised $308 million counts as a success, a modest one perhaps, but a success nonetheless.
“That’s the world we live in,” says Iram. “We founded the company during a period when the cost of capital was zero. There was a ‘sugar rush’; everything was easy. But the world has changed, and in this new reality, being acquired by a giant corporation that brings your product to its global customer base, that is a success. As for anyone wanting to dwell on how much a 2021 investor lost, that’s beyond me.”
You asked investors for money based on the ambitious targets you set. What happened to them?
“The world was completely different when we raised the money. Very few companies were growing at our pace. When I received the term sheet ahead of the funding round in March 2021, we were at an annual sales run rate of $70 million, ten times higher than the previous year. By the time the deal closed three months later, we had already reached $100 million. We doubled our sales the following year.
“As for the market, interest rates were near zero back then. Huge amounts of capital were flowing into venture capital funds, which fueled startups with massive amounts of funding and drove up everyone’s valuations. The market was growing wildly; high-valuation IPOs were happening everywhere, and we, too, were experiencing explosive growth. We didn’t anticipate that the world would look so different two years later.”
What changed?
“Interest rates jumped from zero to 5%, and the funding tap was turned off. The bar for raising capital rose dramatically, meaning only the best companies are managing to raise funds these days. We had already raised a great deal of capital, so we didn’t need to raise more, but we did realize that we would need to grow at a much faster pace to offset the drop in valuation caused by macroeconomic conditions. That is why it took us quite a few years to become profitable. It only happened this past July.”
But the macroeconomic picture is only part of the story. You offer cyberattack insurance, and such attacks have only increased in recent years. Were your forecasts off the mark?
“There wasn’t much that could be done on the insurance side. During those years, the market simply stalled. The war in Ukraine led to a drop in the volume of cyberattacks in the United States, since most attacks originated in Russia and Eastern Europe and the focus shifted to the war. Furthermore, insurance companies began pouring significant capital into the cyber sector, causing insurance premiums to fall.
“In a startup, you’re building a ship, but you can’t control the ocean waves. Ultimately, further growth in cyber insurance wasn’t feasible. That’s why we expanded into cybersecurity. That’s how we managed to generate revenue. Dealing with the situation is our job as founders. Had we not responded the way we did, the outcome would have been far worse, and we would have been operating at a loss. It all comes down to how quickly you realize the world is changing and how ready you are to do what’s necessary.”
And now, AI is once again turning the industry upside down.
“The concern is that AI will significantly scale up the volume of attacks. Instead of a group of 10 hackers, you suddenly have tens of thousands of bots attacking a single system. It could trigger a cascading wave of damage affecting many victims, like a natural disaster but in cyberspace.
“Right now, it remains a threat that hasn’t yet materialized on a scale that is causing insurers to lose money. However, we are seeing a rise in both the quality and quantity of attacks, which further reinforces our decision to join a massive organization like Munich Re. The AI storm could easily topple smaller players.”
“We discovered we didn’t know how to sell insurance”
Iram, 46, co-founded At-Bay with Roman Itskovich in 2016 to address a market failure: traditional insurance companies lacked the ability to assess, price and manage cyberattack risks for small and medium-sized businesses. Yet At-Bay did more than offer insurance. It also provided cyber threat management and monitoring services to its clients.
“The first time I encountered the issue of cyber insurance was in 2013,” says Iram. “Retail giant Target suffered a very serious and sophisticated attack. The personal details of more than 100 million customers were exposed, and more than 80 million credit cards were stolen. Its insurance company incurred massive losses from the attack and referred the case to me in my capacity as head of cyber operations at K2 Integrity, a U.S.-based risk management consultancy.
“I realized that the company had approached the incident without a proper grasp of the risk level, and, crucially, that it had no way of doing so, as this entire domain lay outside the scope of traditional insurance companies.
“That was when the idea of founding a cyber insurance company first occurred to me, though it only materialized in 2016, when venture capitalist Tilli Kalisky approached me with a proposal to launch such a venture. I knew I could only pull it off with Roman, a colleague I had worked with for years. He is a fintech genius and a powerhouse. At the time, he was establishing small-business lending operations in London for a British fund. So, we moved to Palo Alto, California, together and began building the company.”
Why is a dedicated cyber insurance company actually needed?
“Because in established sectors, like car accidents, for instance, the statistical data is so robust that there isn’t much left to investigate or discover. But no one knew how to predict the likelihood of a small business suffering a cyber breach or how to price the resulting damages. And in insurance, any calculation error carries serious consequences.”
What did you do that other insurance companies didn’t?
“We eliminated the long, complex questionnaires that insurance agents usually have to fill out, asking things like which antivirus software you use, how many customer credit cards you store, and so on. None of that matters. Instead, we scan the company’s websites to check for security vulnerabilities.
“We approach the situation like an attacker looking at you from the outside, trying to determine if you have a target on your back and exactly where it is. The challenge was linking our findings to insurance pricing, something that hadn’t been done before.”
At-Bay launched its service in 2018 but initially struggled to market it.
“We realized we didn’t understand how insurance is sold,” says Iram. “We discovered that sales happen primarily through agencies that offer cyber insurance as part of a broader portfolio of policies. And agents from major firms don’t work with just anyone. They look for a track record, an assurance that you know what you’re doing.
“So, we brought in a senior industry veteran to manage our underwriting and sales operations and streamlined the process for agents, simplifying and condensing the insurance product to make it easier for them to work with.”
Once that challenge was overcome, growth was rapid. According to Iram, At-Bay sold approximately $1 million worth of insurance in 2019. The following year, that figure jumped to $25 million, and by 2021, it reached $100 million.
“It happened because the rise of Bitcoin triggered a wave of ransomware attacks,” he explains. “Insurance companies lost huge sums and panicked because they didn’t understand the risk. To avoid insuring clients, they simply doubled their prices. We were left virtually alone in the cyber insurance market, save for two competitors. It was a dramatic shift.”
At-Bay became a prominent name in the burgeoning field of cyber insurance. In 2023, the company was ranked among Forbes’ top 50 fintech companies, and a year later, it was included in Fortune’s list of the top 60 cybersecurity companies.
The challenge, however, was that the industry had shifted. Cyber threats had subsided while more insurance companies entered the market, driving down prices and hurting At-Bay. The company was forced to reinvent itself.
The solution was to evolve into a company that not only sold cyber insurance but also offered the corresponding security services.
“Instead of growing from 40,000 insurance customers to 80,000, we wanted all 40,000 of our existing insurance clients to become security customers as well. So, in 2023, we launched cyber monitoring and security services. Today, a quarter of our clients use our security services too.”
“The war shook us up. We realized that only in Israel would we feel a sense of belonging.”
Iram grew up in Herzliya, except for three years spent living in the children’s quarters at Kibbutz Lehavot HaBashan.
“I know the children’s quarters are often maligned,” he says. “But for me, sleeping together, showering together and running off in the evening to play in the wadi without any adults around, those were the best years of my life.”
His father, Gadi, was a mechanical engineer and owned a jewelry factory, while his mother, Ilil, worked in set and costume design for the theater.
He stood out for his abilities from a young age. In elementary school, he skipped directly from first to third grade.
“My parents were incredibly proud of me, but ultimately, being a year younger than everyone else made things harder for me, because school is far more of a social experience than an academic one,” he recounts. “When everyone else was getting their driver’s licenses, I was still riding a bicycle. And since I finished high school at 17, by the time I enlisted, my friends were already NCOs nearing the end of their service. It was frustrating.”
He served as an officer in the IDF’s Unit 8200, earned a bachelor’s degree in computer engineering from the Hebrew University and began working as a software engineer at RAD Data Communications.
“But after a few months, I saw that my manager and his superiors were still buried deep in highly technical work, and I told myself there was no way I’d be doing that for the next 10 years. So, I left for the consulting firm McKinsey. There, I had the opportunity to advise governments and CEOs of major organizations, both in Israel and globally, on some of the toughest challenges out there. That was truly exciting.”
It was at McKinsey that Iram met Itskovich, who would later become his partner at At-Bay.
“After two years at McKinsey, we were told we should pursue an MBA at Harvard, and they even covered the cost. Getting into highly selective programs is actually something I excel at. That held true for the Talpiot program, McKinsey and Harvard. We were both accepted out of a pool of 500 candidates.”
In 2014, after completing his degree, Iram and his family returned to Tel Aviv. He began working at K2, while his wife, Tal, completed a PhD in neurobiology through a joint program between Harvard and Tel Aviv University.
However, the new Israeli chapter was short-lived. In 2016, the Iram family flew back to the United States and settled in Palo Alto. There, Rotem founded At-Bay, while Tal conducted a postdoctoral fellowship at Stanford focusing on brain aging research. They lived there and raised their three children until deciding to return to Tel Aviv two years ago.
Why did you return to Israel when you run an American business, and during a war no less, when the flow of people is moving in the opposite direction?
“It started on October 7. It’s a deeply unsettling experience to be so far away while events back home are unfolding the way they were. It shook our fundamental belief that our country would always endure and always be okay. I felt I couldn’t just go to work as if nothing had happened. I also had many employees in Israel who had been called up for military service.
“The next turning point was the night of the drone attack in April 2024. We were celebrating my wife’s birthday when we suddenly heard that Iran had launched 300 drones at Israel. It was a surreal moment. We were at a party with 20 friends in Palo Alto, yet our minds were entirely focused on what was happening back in Israel. That’s when we realized we weren’t where we were meant to be.
“At the same time, my wife had to make a decision about the next step in her career, where to set up a lab and train students. That’s a commitment spanning at least a decade. She had received several excellent offers, one of which was from the Weizmann Institute. She said she preferred to raise the next generation of scientists from within Israel, and I said I could manage a life that straddled Tel Aviv and Palo Alto for a few years.”
What were you missing there?
“There are things in life that matter more than comfort. Ultimately, my strongest sense of belonging is here in Israel. Our children attended an Israeli school in California, and all our friends were Israeli. But the surrounding environment didn’t really resonate with us.
“You find yourself constantly gravitating back to the Israeli community, a group deeply connected to ‘home.’ To everyone else, your customs are just a curiosity, like a piñata at a Mexican birthday party.
“Sure, Israel doesn’t have Amazon, which is very frustrating,” he says with a laugh, “but our happiness comes from a sense of purpose. Tal and I feel that here, we can lead the most meaningful lives possible. Plus, our parents are approaching 70, and it’s important to us that they, along with our siblings and their children, play a significant role in our own children’s lives.”
Now your life is here, but the business is still there.
“True, and the price of that is a demanding lifestyle, which includes at least 20 trips a year to the United States. Managing a company in America from Israel is tough. You have to be at your sharpest at night. In the afternoon and evening, you can’t be with your family and children because you work according to U.S. time, and it’s morning there. And in the mornings here, you slip away because you’re burning to work, but everyone’s asleep. I’ve been living like this for two years and I still haven’t resolved the mornings.”
And culturally, have you already acclimated back to Israel?
“There is a difficulty. There is almost unbearable rudeness here on a daily basis. There is no personal space or a culture of standing in line. For better or for worse, there is no respect for institutions here, and screwing up the system is a positive value.
“When it happens on the American street, I don’t care, because I think, ‘You are not related to me, I am not part of you.’ They will do extraordinary things for you. This is what is so frustrating about Israel. It is so beautiful in an emergency, and so difficult in the ordinary.”
Now At-Bay will be merged into Munich Re. What is your next step?
“The Germans have committed to expanding the development center in Israel, and we intend to start selling insurance integrated with cybersecurity here as well this month. We will be the first player to bring this capability here.”
Will you leave the company when the sale is approved?
“In the coming years, I will be there, but I would be very surprised if in 20 years I am still managing the company. I think I will continue to look for important things to work on.
“That is why I did not want to start a cyber company that sells another feature, but one that can change the balance between attackers and defenders. It will take more time to get there, but we have already made the first big push. We have reshaped this industry, which now takes responsibility for both insurance and security, deeply investigates the new data and understands it. The world will no longer be the same in this context.
“I have learned in my journey to trust my intuition and my ability to solve problems. So I’m not afraid of new fields.”
