If you've spent the last few years shopping cyber insurance on behalf of your clients, you've probably noticed something different about Resilience. While most carriers treat cyber insurance like traditional property and casualty coverage—you apply, you get underwritten, you get bound, and then you're largely left alone for 12 months—Resilience operates on a fundamentally different principle.
Resilience is an MGA (Managing General Agent), not a traditional carrier. They control underwriting and claims but use capacity partners to hold the risk. More importantly, they've built their entire model around a thesis that most carriers haven't embraced: cyber insurance should be an active risk management tool, not just a financial backup plan.
That distinction matters enormously for brokers. It changes how you prepare clients. It changes what questions to ask. It changes what renewal looks like. And it opens up conversations with risk managers and IT leaders that go far beyond the traditional "fill out the application and pray nothing bad happens" dynamic.
This guide walks through exactly how Resilience works—from the MGA model through their Edge Solutions platform, their underwriting philosophy, and what you need to do to successfully place your clients with them.
The MGA Model: Why Resilience Operates Differently Than Carriers
First, let's establish what makes Resilience structurally different.
A traditional cyber carrier—think Chubb, AIG, or Hartford—underwrites and holds risk on their own balance sheet. When they bind a policy, they're personally assuming the financial exposure. This creates natural incentives toward conservatism: decline risky clients, charge high premiums, minimize claims payouts.
Resilience operates as an MGA. This means:
- Resilience controls underwriting decisions. They define who gets coverage and under what terms.
- Capacity partners hold the risk. Resilience's reinsurance and partnership agreements transfer the actual financial risk to other entities (often institutional reinsurers or Lloyd's syndicates) [1].
- Resilience doesn't carry balance sheet risk. This structural difference creates different incentives.
Why does this matter? Because an MGA that doesn't carry its own risk has more freedom to innovate and take calculated risks on clients. A traditional carrier has to worry about overall loss ratios across their entire portfolio. An MGA can afford to invest heavily in early-stage risk management tools because they're not carrying the tail risk themselves.
Resilience's leverage play is simple: provide extraordinary risk visibility and continuous monitoring throughout the policy term, identify and help remediate vulnerabilities before they become claims, and thereby improve underwriting performance for their capacity partners. It's a collaborative model, not a "we take your premium and hope nothing happens" model.
This is why Resilience has invested so heavily in their Edge Solutions platform. It's not just a nice-to-have marketing advantage. It's a core business differentiator that justifies their existence as an MGA.
Understanding Resilience's Edge Solutions Platform
Edge Solutions is Resilience's flagship product. It's a continuous risk management platform that monitors your client's security posture throughout the policy period—not just at application time, but continuously [2].
The platform has four main components:
1. Risk Profile Builder
The Risk Profile Builder is the entry point. Unlike traditional applications that feel like a 50-page questionnaire, the Risk Profile Builder combines two types of data and leverages over 180 data signals for comprehensive risk assessment [2]:
Outside-in scanning: Resilience scans your client's external attack surface. This includes internet-facing assets, domain configurations, SSL certificate data, DNS records, known vulnerabilities in exposed systems, and external threat intelligence. This happens automatically—no manual data entry required. The platform also integrates APIs with third-party cloud services and internal systems to perform continuous assessment of both external attack-surface exposure and dark-web exposure [2].
Inside-out questionnaire: Your client answers targeted questions about internal security controls, policies, and posture. But because Resilience already has external data, the questionnaire is smarter. It validates answers against observable reality and focuses on controls that external scanning can't directly observe.
The result is a Risk Profile that combines verified external data with documented internal controls. This is far more accurate than traditional applications, which rely 100% on self-reported information. The comprehensive assessment draws from self-reported information plus external attack-surface intelligence, creating a richer baseline than questionnaires alone [2].
For brokers, the Risk Profile Builder matters because you can walk clients through it before they formally apply. This serves as a diagnostic tool. Clients can see what areas need attention and understand their risk posture before they even hit formal underwriting [3]. The digital portal lets clients view prioritized cybersecurity risks, recommendations, and policy documents in one place—a meaningful advantage when evidence would otherwise scatter across email threads, MSP tickets, PDFs, and broker notes [2].
2. Breach and Attack Simulation (BAS)
This is the genuinely unusual element of Resilience's offering, made possible through their partnership with AttackIQ [4].
Breach and Attack Simulation means Resilience (or a designated third party) runs simulated attacks against your client's environment throughout the policy term. These aren't random penetration tests. They're structured, recurring simulations that test whether your client's security controls actually work against real attack techniques.
An example: Your client claims to have EDR (Endpoint Detection and Response) deployed across all devices. A BAS test runs known-good attack techniques on a test system. If the EDR detects and blocks them, great. If not, the client gets visibility into that gap immediately [4].
Most carriers don't offer this. Why? Because it's resource-intensive, it requires genuine partnerships with offensive security firms, and it creates liability. If you tell a client that their controls should catch a certain attack and they don't, you're on the hook if they suffer a real attack of that type.
Resilience embraces this because the alternative—waiting until you have a real breach to discover that a control didn't work—is worse [4].
For brokers: BAS changes the value proposition entirely. You're no longer just placing insurance. You're helping clients actually test their defenses. This is a conversation worth having with your client's risk and IT leadership.
3. Continuous External Monitoring
Throughout the policy period, Resilience continuously monitors your client's external attack surface with ongoing visibility into external attack-surface risk and dark-web exposure [2]. This includes [2]:
- New vulnerabilities in exposed systems
- Changes in external assets (new domains, exposed buckets, etc.)
- Certificate or DNS configuration issues
- Emergence of the client's credentials in dark web marketplaces
- New threat intelligence correlated to the client's specific industry or footprint
- Continuous IAM monitoring for multi-cloud environments (AWS, GitHub, Google Workspace, M365 support)
Clients receive alerts when new exposures are detected. This is genuinely continuous monitoring—not a quarterly scan, but ongoing surveillance. The platform also incorporates probabilistic attack scenarios and quantification models to help clients understand their risk in business terms [2].
4. Security Recommendations Engine
Based on monitoring data and BAS results, Resilience generates prioritized security recommendations with built-in features for secure collaboration and exposure validation [2]. These recommendations are specific: "Patch CVE-2024-12345 on three systems in your DMZ" rather than "improve your patch management process." The engine also integrates vendor-risk analysis and delivers risk analysis with ROI-prioritized mitigation planning to help clients focus on high-impact improvements [2].
Clients can log into the Edge Solutions dashboard, see their current risk profile, view security recommendations, track remediation progress, and see how their posture trends over time. This centralized visibility eliminates the common problem of evidence scattered across email threads, MSP tickets, PDFs, and broker notes.
What Resilience Looks For in Underwriting
Let's get tactical. When a broker submits an application to Resilience, what are they actually evaluating?
Resilience's underwriting focuses on core security controls that directly impact breach likelihood and severity. Based on their public guidance and industry commentary, the main areas are [5]:
Multi-Factor Authentication (MFA): Resilience wants to see MFA deployed across critical systems, especially email and administrative access. If MFA is spotty or not deployed, expect pushback during underwriting or quotes that reflect higher risk [5].
Endpoint Detection and Response (EDR): Resilience expects EDR or equivalent capabilities on business-critical systems. They understand that not every organization runs EDR enterprise-wide, but they want to see it where it matters most [5].
Email Security: Email is the primary attack vector. Resilience evaluates DMARC/SPF/DKIM implementation, email filtering, user awareness training, and email authentication mechanisms [5].
Backup Architecture: This is critical for ransomware coverage. Resilience wants to see evidence of offline backups, backup testing, and recovery time objectives. Clients with "backups we've never tested" will get lower marks than clients with documented recovery processes [5].
Privileged Access Management (PAM): How does the client control and monitor who has administrative access? Resilience looks for evidence of least-privilege principles, centralized logging, and regular access reviews [5].
Patch Management: Resilience evaluates patch cadence, whether patches are applied to all relevant systems (servers, endpoints, network devices), and whether there's a tested process for emergency patching [5].
Incident Response Plan: Does the client have a documented incident response plan? Have they tested it? Do they have third-party retainers (forensics, legal, PR) in place [5]?
Network Segmentation: Can the client isolate compromised systems? Do they segment critical assets? This limits blast radius—a core actuarial concern [5].
The 85% Ransomware Avoidance Claim: What It Actually Means
Resilience has publicly discussed an 85% ransomware avoidance rate among their policyholders. This statistic deserves unpacking because it's unusual and somewhat remarkable [1].
The claim is: among Resilience policyholders who faced a ransomware attack (i.e., they had malware deployed in their environment), 85% avoided paying ransom. They either restored from backup, identified and isolated the attack early, or otherwise recovered without capitulating to extortion [1].
What does this actually tell us?
First, it suggests that Resilience's portfolio has materially better backup and detection capabilities than the industry baseline. You don't get an 85% avoidance rate without clients who have offline backups and systems that can actually detect attack activity in progress.
Second, it indicates that Resilience's continuous monitoring and BAS approach genuinely improves outcomes. Clients who run simulated attacks and receive specific remediation guidance are in a better position to detect and respond to real attacks [1].
Third, it highlights the difference between "cyber insurance" and "active cyber risk management." An insurance policy doesn't prevent ransomware attacks. But continuous monitoring, BAS, and security recommendations do make attacks less likely to succeed.
For brokers, the 85% claim is a value proposition conversation. You're not just buying insurance. You're buying a platform that measurably reduces the likelihood of expensive catastrophic outcomes.
The Policy Limits Problem: Why Attackers Are Calibrating Ransom Demands to Coverage
Here's an insight that Resilience has been vocal about, and it's worth understanding because it changes how brokers should think about limits [1].
Attackers have figured out that cyber insurance policies have limits. And they're using those limits to calibrate ransom demands.
An attacker breaches a mid-market company. They steal data and deploy ransomware. They notice during reconnaissance that the company has cyber insurance. Through various tactics (sometimes directly asking for policy information, sometimes inferring from company size and industry), they get a sense of likely coverage limits. A typical mid-market cyber policy might have a $5M limit. The attacker then demands $4.5M—enough to exhaust the policy but within a single insurance contract [1].
Why is this a problem?
Because it decouples ransom demands from actual damage. In an ideal world, ransoms reflect the value of the encrypted data to the attacker (intellectual property, customer data, operational disruption cost). But if attackers know the insurance limit, they simply demand up to that limit, regardless of the actual value [1].
Resilience's solution isn't to just increase limits. It's to reduce the likelihood of ransom situations altogether through better defenses. But there's a secondary implication: brokers should think carefully about limits in context of industry, company size, and actual exposure—not just as a checkbox exercise [1].
Resilience offers limits up to $20M, but the emphasis is on getting the limit right for your client's actual exposure, not on buying the highest limit available [1].
How Resilience Underwriting Works in Practice
Unlike some carriers that give you a binary yes/no underwriting decision within a week, Resilience's process is more collaborative.
Pre-qualification: You submit basic information through the online portal. Resilience runs a quick scan against external data. This typically takes 24-48 hours and indicates whether a client is even in their sweet spot.
Risk Profile Building: Assuming pre-qualification passes, your client accesses the Risk Profile Builder. They complete the questionnaire and authorize external scanning. This usually takes a few days and generates the initial Risk Profile.
Formal Underwriting: Based on the Risk Profile, a Resilience underwriter engages. If there are gaps, they'll typically discuss remediation options rather than immediately declining [6].
Security Improvement Plan (SIP): If a client has material gaps, Resilience often offers to bind coverage with a Security Improvement Plan as a condition. The SIP is a timeline for addressing specific vulnerabilities. Clients can get bound while working on remediations, provided there's a clear plan [6].
Binding: Once underwriting approves, coverage can typically be bound within a few days.
The whole process from submission to binding usually takes 2-3 weeks—longer than some carriers but shorter than others. The emphasis is on getting the data right rather than rushing to a decision [6].
Renewal with Resilience: Continuous Data and Midterm Enhancements
Here's where the MGA model and continuous monitoring really matter—and where Resilience breaks from traditional carrier renewal workflows.
Traditional carriers treat renewal like a fresh underwriting. You submit a new application. They re-evaluate your controls. If something changed materially, you might see a rate increase or an exposure reduction [7].
Resilience renewal is fundamentally different for two reasons.
First, they have 12 months of continuous monitoring data. They know:
- Whether your security controls actually worked (BAS data)
- Whether vulnerabilities were remediated on schedule (monitoring data)
- How your posture trended over the year (historical data from the Edge Solutions dashboard)
- Whether you had any material incidents or security events (claims/incident data)
Renewal isn't a "fill out the application again" exercise. It's a conversation based on actual performance data. If your client improved their posture, their renewal quote likely reflects that. If they neglected recommended remediations, they'll feel that in pricing [7].
Second—and this is unusual in the market—Resilience's FAQ explicitly states that improved cybersecurity controls can lead to enhanced terms, including midterm changes to coverage, limits, and retention for eligible clients. This doesn't just happen at renewal. It can happen during the policy term [1]. This is a meaningful differentiator: while most carriers lock terms for 12 months, Resilience will upgrade eligible clients mid-term if they demonstrate genuine control improvements and ongoing engagement with Resilience security experts [1].
For brokers, this means renewal is actually a coaching conversation—and potentially an opportunity for mid-term enhancements. You and the client should be logging into their Edge Solutions dashboard quarterly and discussing progress on recommended remediations. Don't wait until renewal to have that conversation. If your client is making real progress, bring that to Resilience's attention. You might unlock a mid-policy improvement [7].
Common Mistakes Brokers Make with Resilience (And How to Avoid Them)
Mistake #1: Treating the Risk Profile Builder Like Optional
Some brokers view the Risk Profile Builder as an extra step and submit traditional applications instead. This is a missed opportunity. The Risk Profile Builder is superior to traditional applications because it combines outside-in data with inside-out controls. Use it [3].
How to avoid: Walk every client through the Risk Profile Builder before formal underwriting. Treat it as a pre-underwriting diagnostic that helps clients understand their posture.
Mistake #2: Not Preparing Your Client for BAS Testing
Breach and Attack Simulation can be startling if you don't prepare the client. They might see alerts fire in their environment and worry they've been actually compromised. Or they might not understand why Resilience is running what looks like an attack against their systems [4].
How to avoid: Explain upfront that BAS is a structured, authorized testing process. Help your client prepare their SOC and IT teams. Make sure they understand it's a feature, not a bug.
Mistake #3: Underestimating the Importance of Backup Architecture
Ransomware is the leading cyber claim. Backup architecture is the primary defense against ransom situations. Yet many brokers don't dig deep into whether clients actually have offline backups, how regularly they test recovery, and what their RTO/RPO looks like [5].
How to avoid: Make backup architecture a formal part of your pre-underwriting conversation. Ask: Do you have offline backups? When did you last test a full recovery? What's your target recovery time? Document the answers clearly.
Mistake #4: Not Explaining the Value of Continuous Monitoring
Some brokers view the Edge Solutions platform as a nice add-on. But the continuous monitoring, BAS, and recommendations are actually the core value proposition. They directly impact loss prevention and renewal pricing [2].
How to avoid: In your proposal presentations to clients, position Edge Solutions as the main reason to choose Resilience—not just a policy feature. Highlight specific ways continuous monitoring will reduce their risk during the year.
The Broker Prep Checklist: How to Successfully Place a Client with Resilience
Use this checklist before submitting a Resilience application:
- Backup Architecture: Document offline backups, backup testing history, and recovery time objectives. Be specific.
- MFA Deployment: Identify where MFA is deployed (email, admin access, VPN, etc.). Note any gaps.
- EDR/Detection: List systems covered by EDR or equivalent detection tools. Identify blind spots.
- Incident Response: Confirm the client has a documented IR plan. Do they have third-party retainers (forensics, legal)?
- Patch Management: Get evidence of patch cadence. How are patches prioritized? What's the process for emergency patches?
- Network Segmentation: Does the client have network segmentation? Are critical assets isolated?
- Email Security: What email authentication (DMARC, SPF, DKIM) is implemented? Any email filtering beyond basic spam filtering?
- Risk Owner Identification: Identify the IT/security leader and the business risk owner who will engage with Edge Solutions.
- Compliance Requirements: Note any compliance requirements (HIPAA, PCI, SOC 2) that might inform coverage needs.
- Claims History: Document any prior security incidents or data breaches, even if they didn't result in claims.
With this information in hand, you can have a confident conversation with Resilience and set your client up for successful underwriting.
Where BindLedger Fits: Accelerating Your Resilience Placement
If you're placing clients with Resilience, you probably know the challenge: gathering accurate security control information is tedious. Clients often don't have centralized visibility into their own infrastructure. Questionnaires feel repetitive across carriers. Risk profiles end up incomplete because you're relying on clients to know details they might not track [3].
This is where BindLedger's tools help:
The /scan tool gives you a quick outside-in snapshot of your client's external posture—internet-facing assets, exposed vulnerabilities, SSL certificate issues. Use this as a starting point for your Resilience placement conversation. You'll identify obvious gaps before underwriting even begins [3].
The Carrier Decoder (formerly Supplement Parser) lets you extract exactly what Resilience requires from their underwriting guidelines. Load their questionnaire or underwriting materials into the Carrier Decoder, and you get a prioritized list of information you actually need to gather. No more wading through entire 50-page guides [3].
Both tools accelerate your placement process and ensure you're submitting complete, competitive applications to Resilience.
Start a scan now to see your client's external exposure, or use the Carrier Decoder to extract Resilience's exact requirements for your next application.
Better Controls, Better Terms: Resilience's Explicit Positioning
Most carriers hint that good security controls lead to better pricing. Resilience goes further by publicly stating that improved cybersecurity controls can lead to enhanced coverage terms. This is a critical positioning difference.
Resilience's Risk Manager page explicitly says their cyber and technology E&O policies can offer enhanced coverage, limits, and retention based on ongoing engagement with Resilience security experts [1]. The FAQ reinforces this: improved controls can result in midterm enhancements, not just renewal-time rate adjustments.
For brokers and clients, this reframes the relationship. It's not "we'll lock your rates for 12 months." It's "show us real improvement, stay engaged with our team, and we'll reward that with better terms during the policy term."
To unlock this value proposition, the client's story needs to be credible:
- External attack surface must be visible and improving
- Control improvements must be documented (MFA expansion, EDR deployment, backup validation, etc.)
- Engagement with Resilience experts must be demonstrated through quarterly dashboard reviews and remediation progress
- The before-and-after narrative needs to be clear and measurable
Clients who treat Resilience as a set-it-and-forget-it insurance policy will miss this opportunity entirely. Those who engage actively with the platform and use it to drive measurable improvements have access to a level of insurance flexibility that traditional carriers simply don't offer [1].
Comparing Resilience to Other Carriers: Context
Resilience is different from traditional carriers in meaningful ways, but it's worth contextualizing how they fit in the broader cyber insurance landscape.
vs. AIG Cyber Edge: AIG is a massive carrier with strong claims handling but more traditional underwriting. AIG requires more detailed applications and takes longer to underwrite. Resilience moves faster and offers continuous monitoring that AIG doesn't. Resilience is better if you want an MGA that actively manages risk throughout the policy term. AIG is better if you want a globally-recognized carrier and don't need ongoing monitoring [8].
vs. CFC: CFC is another innovative carrier known for strong claims handling and flexible underwriting. CFC and Resilience have similar philosophies—they'll work with clients who have gaps if there's a clear remediation plan. The main difference: CFC offers more customization and flexibility in policy terms, while Resilience is more standardized but includes continuous monitoring as a baseline. For brokers, this matters if your client needs bespoke coverage (CFC) vs. best-in-class risk management (Resilience) [9].
Want deeper comparative analysis? See our guides: "How to Answer the AIG CyberEdge Application" and "How CFC Underwrites Cyber Insurance".
Frequently Asked Questions
Q: Does Resilience actually cover all ransomware situations?
A: No cyber insurance covers ransom payments directly (those are typically excluded). Resilience's value is in reducing the likelihood that you need to pay ransom at all, through better backups and detection. Their 85% avoidance rate reflects cases where clients recovered without paying, thanks to good defenses that Resilience helped validate through BAS and monitoring.
Q: Can we use our existing cyber policy while we're in a Security Improvement Plan with Resilience?
A: That depends on the timeline. Typically, if a Security Improvement Plan is part of a binding with Resilience, you'd move to them even if the SIP has a 3-6 month timeline. But confirm specifics with your Resilience underwriter. Sometimes carriers will allow temporary side-A or tail coverage during transition [6].
Q: What happens if BAS testing reveals significant gaps in our controls?
A: The goal isn't to penalize you. If BAS reveals a gap (for example, "your EDR didn't detect this known-good attack technique"), you get specific data about what needs remediation. You and Resilience then develop a plan to address it—either before binding or as part of the Security Improvement Plan [4].
Q: How much does Resilience cost compared to other carriers?
A: Pricing is highly dependent on industry, revenue, controls, and claims history. Resilience isn't the cheapest carrier, but they're not necessarily the most expensive either. The value proposition isn't "lowest premium"—it's "active risk management throughout the policy term." Evaluate total value, not just price [1].
Key Takeaways for Brokers
-
Resilience is fundamentally different: They're an MGA operating under a continuous risk management model, not a traditional carrier playing defense.
-
Edge Solutions is the main value proposition: Continuous monitoring, BAS testing, and risk recommendations directly reduce the likelihood of major claims. This isn't just insurance—it's active risk management.
-
Underwriting is collaborative: Resilience will work with clients who have gaps if there's a credible path to remediation. But you need to prepare clients properly and set clear expectations.
-
Renewal changes everything: Resilience has a full year of performance data. If your client took recommended actions, renewal reflects that. If they didn't, they'll see it in pricing or terms.
-
Preparation matters: The more detail you provide in the initial Risk Profile and supporting documentation, the smoother underwriting goes. Use tools like BindLedger's scanner to gather accurate baseline data.
-
The 85% ransomware avoidance claim is real: It reflects better defenses, better detection, and better preparedness among Resilience's portfolio. That's a competitive advantage worth highlighting to your clients.
Final Thought
Cyber insurance is rapidly evolving from a reactive, coverage-only product to a proactive risk management tool. Resilience is leading that evolution. They've built a business model that doesn't just promise to pay claims—they actively work to prevent the catastrophic events that require claims in the first place.
For brokers, that shift creates an opportunity: instead of transactional conversations about coverage limits and deductibles, you can have strategic conversations with your clients about resilience, preparedness, and measurable risk reduction.
That's worth more than a low premium. That's worth a client who actually survives a cyber attack without losing their business.