Coalition

United States – October 17, 2026 -- Coalition says policies it provided paid more than $315 million in cyber claims in 2025. The insurer is urging brokers to counter the belief that cyber insurance does not pay claims, an objection it says can stall coverage decisions.

Zero-indemnity closures reflect early intervention, Coalition argues

The National Association of Insurance Commissioners (NAIC) reported that 26% of cyber claims in 2025 closed with indemnity payments. Verizon reported a recorded pay-out on 55% of 2025 claims. Coalition says critics read claims closed without an indemnity payment as denials, when many reflect incidents contained early.

London – October 17, 2026 -- Coalition reports 130,000+ global policyholders and $1 billion in global gross written premium on a proforma basis, figures it presented at the debut of Activate Europe, its largest cyber broker event outside the US.

The event drew brokers, underwriters, reinsurers, incident response firms and legal experts, according to the company.

Allianz partnership extends Coalition's enterprise reach across 20+ geographies

Coalition announced a long-term strategic partnership with Allianz in July to bring Active Cyber Insurance to the global enterprise market. Allianz supplies AA-rated capacity, global reach and infrastructure for international programs. Coalition contributes real-time risk intelligence, data-driven underwriting, active protection and specialised claims response.

Global – October 17, 2026 -- Coalition says its Wirespeed platform cuts alert noise by 99.99% before any alert reaches a customer queue, replacing analyst-driven managed detection and response (MDR) with automated verdicts and containment in milliseconds.

Coalition acquired Wirespeed to address a bottleneck it attributes to legacy MDR: human analyst capacity. Adding headcount widens the alert queue and raises prices for customers without speeding up response, the company argues. Forrester Research recognized Coalition in its report The Managed Detection And Response Services Landscape, Q3 2026.

Global – October 17, 2026 -- Citrix confirmed on September 27 that two critical NetScaler zero-day vulnerabilities, each scoring 9.5 in severity, were exploited in the wild. According to cyber insurer Coalition, the vendor's public communications lagged the first reports by at least 36 hours.

Two flaws allow remote code execution on unpatched NetScaler appliances

CVE-2026-88771 is a critical remote code execution (RCE) flaw that lets an unauthenticated attacker run arbitrary commands. CVE-2026-88772 is a memory overflow vulnerability that can lead to RCE or a denial-of-service condition. The Citrix patch also fixes six other flaws, bringing the total to eight.

NetScaler provides remote access to internal applications and desktops and is often exposed directly to the internet, which makes it a frequent target. Enterprises across all industries use it.

Global -- Coalition sent just 49 Zero-Day Alerts (ZDAs) between May 1 and August 1, 2026, even as Microsoft's July Patch Tuesday swelled to 569 vulnerabilities, and 94% of its policyholders did not receive a single one.

Microsoft's Patch Tuesday count nearly triples in one month

June's Patch Tuesday set a record with 206 vulnerabilities. July's release nearly tripled that to 569. Before Microsoft adopted multi-model AI for vulnerability discovery, it typically shipped around 100 fixes a month. Windows said in July that it would apply AI across security analysis to find flaws earlier and at greater scale, which Coalition says likely contributed to the jump.

Attackers are also moving faster. Anthropic disclosed earlier this year that Mythos could create working exploits for newly discovered vulnerabilities in hours rather than weeks.

Global – October 17, 2026 -- ConnectWise is investigating attempted unauthorized access to its Cloud Backup for Microsoft 365 service, formerly SkyKick Cloud Backup, after disclosing the incident on October 16. The company says containment measures are in place and it has no indication that partner backup data was accessed. The investigation is ongoing.

Community reports allege attacker used the backup app's Entra credentials

Separate reports in the MSP community describe an attacker using the backup service's Microsoft Entra application to enter customer tenants and exfiltrate email, SharePoint and Teams data. ConnectWise has not confirmed these reports.

ConnectWise published indicators tied to the suspicious authentication activity: source IP 144.172.64.128 and the user agents Python-urllib/3.12 and python-requests/2.31. The company notes that their presence alone does not confirm compromise.