Cogitanda

Cogitanda
COGITANDA Dataprotect AG
Corporate identity
Type	Private — cyber insurtech MGA (Assekuradeur)
Incorporation	Germany
Founded	2016 (2016)
Headquarters	Flensburg, Germany
Domicile	Germany
Licensed jurisdictions	Germany Austria
Ultimate parent	DGC AG
Major shareholders	DGC AG
Key people	Walid Schalesi, Group Chief Actuary Alain Bianco, Group Chief Underwriting Officer
Number of employees	approximately 70 (March 2025)
Business & markets
Customer segments	Small and medium-sized enterprises Industrial companies
Lines of business	Cyber insurance
Main products & services	Cyber Pro+ CYBERPROTECTION
Technology platform	cyberscan.io (vulnerability detection) AXON (broker quoting portal) Cyber Defence Operation Center (CDOC)
Capacity providers	SV SparkassenVersicherung Gebäudeversicherung AG Württembergische Versicherung AG Everest Insurance IQUW
Distribution	Broker-centric; portal-driven
Geographic markets	Germany Austria
Competitors	Stoïk Eye Security Baobab Insurance At-Bay Coalition Corvus Insurance Cowbell Resilience

🏢 Cogitanda is a Germany-origin cyber insurance MGA (Assekuradeur) founded in 2016 that operates under delegated authority, placing cyber coverage with multiple external risk carriers while providing end-to-end claims management and cyber risk prevention services. The pre-insolvency group comprised five German entities — COGITANDA Dataprotect AG, Risk Prevention GmbH, Insurance Services GmbH, Claims Services GmbH, and Managed Services GmbH — spanning the full cycle from underwriting design to incident coordination. Following the sudden death of founder Jörg Wälder in 2023 and subsequent economic distress, the group entered insolvency in November 2024 and was acquired via asset deal by DGC AG in March 2025, with the brand retained and operations continuing from Flensburg.

👥 Leadership. Named executives include Walid Schalesi (Group Chief Actuary) and Alain Bianco (Group Chief Underwriting Officer), confirmed in post-acquisition product communications. Jens Lison was referenced as CEO of COGITANDA Dataprotect AG in 2024 capacity expansion coverage, though his current post-acquisition role is unconfirmed. The acquisition preserved the core team and key personnel, with approximately 70 employees transferred in the asset deal from a pre-insolvency group of roughly 150.

🔄 Business model. Cogitanda's integrated model spans three functions: delegated-authority placement of cyber insurance with multiple external risk carriers, end-to-end cyber claims management performed on behalf of those carriers, and cyber risk prevention services for policyholders and broker networks. The current website positions this as "360° cyber protection," integrating prevention, monitoring, insurance, and crisis management alongside DGC's cybersecurity infrastructure. The company historically operated in Germany with documented expansion into Austria.

📦 Legacy products. The established Cyber Pro+ product was a modular, configurable offering organized around five coverage groups: attacks on reputation and identity, attacks on payment methods and accounts, attacks on hardware/software and data, business interruption, and liability and data protection incidents. Formal policy conditions (AVB Version 1.0) date to July 2019, and the product included an explicit war exclusion clause. An additional "technical insurance" component covered electronics and machinery with simplified declaration mechanics.

🚀 Post-acquisition products. CYBERPROTECTION was launched after the DGC acquisition as a new cyber insurance product with a digital application workflow and a built-in CYBERPROTECTION Check risk assessment. The product features tiered structuring (Smart, Advanced, Extended) with streamlined underwriting for specific revenue bands. Embedded incident coordination includes a 24/7 cyber claims hotline, expert crisis team assembly, structured daily briefings, and forensic integrity protocols.

🔍 Cybersecurity services. Prevention and monitoring capabilities draw on DGC's infrastructure, including external vulnerability detection via cyberscan.io, penetration testing, security awareness training, and a 24/7 Cyber Defence Operation Center (CDOC). Legacy brochures describe a prevention stack encompassing employee training, audits, vulnerability analyses, and monitoring. Post-incident response orchestration is documented in a detailed emergency plan covering forensic data requirements, network topology collection, and law enforcement coordination.

🤝 Distribution and capacity. Distribution is broker-centric with a portal-driven workflow; the AXON quoting platform remained accessible during the insolvency period. Two German risk carriers — SV SparkassenVersicherung Gebäudeversicherung AG and Württembergische Versicherung AG — continued to support new business and renewals post-acquisition. International capacity from Everest Insurance and IQUW expanded the product for clients with revenues up to €250 million in Germany and Austria, with policy limits up to €7.5 million.

🏅 Competitive positioning. Cogitanda aligns with the European cyber MGA and services cluster, competing against US platforms such as At-Bay, Coalition, Corvus Insurance, Cowbell, and Resilience, and European challengers including Stoïk, Eye Security, Baobab Insurance, and Dattak. Its competitive moat rests on integrated prevention-insurance-incident management, broker portal lock-in, and demonstrated capacity continuity through insolvency. Academic research underscores structural challenges including systemic aggregation risk and war exclusion uncertainty.

⚠️ Risks and outlook. Key risk factors include strong dependency on third-party capacity providers, systemic cyber aggregation exposure, war exclusion and attribution dispute risk, post-insolvency integration challenges in re-establishing contracts and controls under new group governance, and historical key-person risk sharply demonstrated by the founder's death as a direct precursor to insolvency. Cogitanda's post-acquisition strategy centers on the combined cybersecurity and insurance proposition, leveraging DGC's security operations and a digitized underwriting workflow to rebuild and scale the business under new ownership.

The following sections provide further details.

~*~

Corporate profile

🏢 German cyber MGA. Cogitanda is a Germany-origin cyber risk specialist that combines cyber insurance distribution and underwriting design with cyber risk prevention and claims-coordination services. The pre-insolvency operating model was that of an Assekuradeur — the German market equivalent of an MGA operating under delegated authority — paired with in-house cyber prevention and incident management capabilities. The company was founded in 2016 and historically operated from Germany, with documented expansion into Austria for at least part of its cyber product offering.

⚠️ Insolvency and acquisition. A material corporate discontinuity occurred between late 2024 and early 2025. Multiple Cogitanda group entities entered insolvency proceedings, and the operating business was transferred via an asset deal to a subsidiary of DGC AG, with the Cogitanda brand retained and operations stated as continuing. The insolvency was filed in November 2024, at which point a preliminary insolvency administrator was appointed and continuity of customer coverage was asserted. The asset deal closed in March 2025, and the company now operates under the DGC group umbrella with headquarters in Flensburg.

🏛️ Pre-insolvency group entities. The most consistently documented group perimeter during the insolvency and sale process comprised five entities: COGITANDA Dataprotect AG, COGITANDA Risk Prevention GmbH (cyber prevention services), COGITANDA Insurance Services GmbH (part of the Assekuradeur model), COGITANDA Claims Services GmbH (claims and incident services), and COGITANDA Managed Services GmbH (managed services), all domiciled in Germany. Buyer-side counsel characterized the group's integrated model as delegated-authority cyber policy placement with multiple risk carriers, end-to-end claims management on behalf of carriers, and prevention services for insureds and brokers.

📋 Regulatory posture. Available evidence points to a delegated-authority model with external risk carriers rather than Cogitanda retaining insurance risk on its own balance sheet. The operating model is broker- and MGA-like — involving delegated authority, multiple risk carriers, and broker distribution — which in Germany typically implies reliance on insurance distribution permissions and registers rather than an insurer authorization. A relationship with Lloyd's syndicate IQUW providing capacity has been reported, though no Lloyd's coverholder number is disclosed.

👥 Scale. During the preliminary insolvency process, total group employees were approximately 150, secured through insolvency wage pre-financing to the end of January 2025. In the asset sale, approximately 70 employees were secured with the transfer. Following the acquisition, DGC's group headcount increased to over 100 employees across Flensburg and Cologne, though this is a group-wide figure and not Cogitanda on a standalone basis.

~*~

Leadership and governance

🪦 Founder. Jörg Wälder founded Cogitanda and served as its central leadership figure. His sudden death in 2023 is widely cited as a key destabilizing event that preceded the company's economic difficulties and subsequent insolvency filing.

👔 Current leadership. The acquisition-era materials confirm continuity of the core team and key personnel, though a full role-by-role roster is not publicly available. Named executives referenced in company-controlled channels include Walid Schalesi (Group Chief Actuary) and Alain Bianco (Group Chief Underwriting Officer). Jens Lison was quoted in 2024 capacity and market expansion coverage as CEO of COGITANDA Dataprotect AG, though that reference predates the acquisition and may not reflect his current role.

~*~

Business model

🔄 Integrated cyber specialist. Cogitanda's model spans three interconnected functions: delegated-authority placement of cyber insurance products with multiple external risk carriers, end-to-end cyber claims management services performed for those carriers, and cyber risk prevention services delivered to policyholders and broker networks. The current website positions this combined offering as "360° cyber protection," integrating prevention, monitoring, insurance, and crisis management alongside DGC's cybersecurity capabilities.

🌍 Geographic footprint. Cogitanda historically operated in Germany with broker distribution and German-language product materials. Market expansion and capacity commentary indicate an Austrian component for at least part of the cyber product offering, with the Everest and IQUW partnership specifically targeting clients in Germany and Austria with revenues up to €250 million.

~*~

Cyber insurance products

📦 Legacy product family. The established pre-2025 cyber product, "Cyber Pro+," was a configurable offering accessed via an online portal and coverage configurator for broker partners. The product was modular, organized around five coverage groups: attacks on reputation and identity, attacks on payment methods and accounts, attacks on hardware/software and data, business interruption, and liability and data protection incidents. A comparative market study references formal policy conditions (AVB COGITANDA Cyber Pro+ Version 1.0, dated July 26, 2019), confirming the product's maturity by that date.

🚀 Post-acquisition product. Following the DGC acquisition, "CYBERPROTECTION" was launched as a new cyber insurance product featuring a digital application workflow and a "CYBERPROTECTION Check" risk assessment component. Company communications describe tiered structuring (Smart, Advanced, Extended) with quantitative underwriting workflow signals, including streamlined risk questioning below certain revenue thresholds and a stated maximum capacity figure.

🛡️ First-party coverages. The five coverage groups encompass reputational harm and identity restoration costs, cybercrime and funds-transfer-related losses, data restoration and system repair costs, and business interruption. An additional component described as "technical insurance" (electronics and machinery insurance) was positioned as a unique supplementary coverage protecting electronics and machines, with simplified declaration mechanics that do not require device listing or subsequent reporting obligations for new devices.

⚖️ Third-party coverages and claims services. The liability and data protection incidents coverage group indicates inclusion of third-party liability and privacy/data protection incident coverage within the configurable product structure. Cogitanda's emergency plan details embedded incident coordination including a 24/7 cyber claims hotline (Germany and international numbers), an incident reporting email address, prompt assembly of an expert crisis team with potential on-site support, and structured daily technical and management briefings during response. Operational guidance emphasizes preserving forensic integrity during incidents.

⚔️ War exclusion. Cyber Pro+ contained an explicit war exclusion clause within its general policy conditions, as documented in a comparative war-clause study across cyber insurers. Ambiguous war constructs in cyber insurance can create coverage uncertainty and litigation risk, particularly in relation to state-sponsored cyber events and attribution disputes — an issue of broad market relevance to cyber underwriting and claims.

🎯 Segment targeting. Legacy materials describe servicing small and medium-sized as well as industrial companies, implying a target market extending beyond micro-SME packaged business. The CYBERPROTECTION product introduces additional tiering and digitized workflows intended to streamline underwriting for specific revenue bands.

~*~

Cybersecurity services

🔍 Prevention and monitoring. Cogitanda's current website emphasizes prevention services that draw on DGC's cybersecurity capabilities, including external vulnerability detection and monitoring via the cyberscan.io platform, penetration testing, security awareness training, and a 24/7 Cyber Defence Operation Center (CDOC). Legacy brochures also describe a prevention stack encompassing employee training, audits, vulnerability analyses, and monitoring.

🚨 Post-incident response. The emergency plan document provides a detailed depiction of crisis orchestration steps and the data requirements for coordinated response, including server and client counts, network topology, logs, communications records, backup status, and law enforcement reference information. This operational workflow reflects embedded crisis management and incident coordination capability within the insurance product offering.

💼 Service delivery model. Legacy materials indicate that prevention services can be provided on request and that the group combines insurance with cyber prevention services. The post-acquisition positioning under DGC further integrates the cybersecurity service stack, leveraging DGC's security operations infrastructure alongside Cogitanda's insurance-specific processes.

~*~

Distribution and capacity

🤝 Broker-centric distribution. Cogitanda's distribution model centers on broker and partner networks, evidenced by a dedicated onboarding flow for broker partners, a portal-driven process for configuring coverage and generating placements, and customer guidance directing insureds to work through their insurance broker. Third-party broker commentary confirmed continued access to the AXON quoting platform during the insolvency period, reinforcing that production was executed through a digital portal workflow.

🏦 German risk carriers. Two incumbent German risk carriers — SV SparkassenVersicherung Gebäudeversicherung AG and Württembergische Versicherung AG — continued to support new business and renewals following the DGC acquisition. Board members of these carriers publicly emphasized the value of Cogitanda's integrated prevention, insurance, and claims management model as a basis for their continued partnership.

🌐 International capacity. Cogitanda partnered with Everest Insurance and IQUW to expand its cyber product offering for clients with revenues up to €250 million in Germany and Austria, with a stated policy limit up to €7.5 million for that expanded segment. The precise legal mechanism governing these relationships — whether a Lloyd's coverholder arrangement or another London market access model — is not publicly documented.

~*~

Financial profile and competitive positioning

📊 Financial opacity. Cogitanda experienced economic distress after 2023 and entered insolvency in late 2024, followed by business transfer and continuation under DGC. Audited financial KPIs including gross written premium, revenue, net income, and loss ratio are not available in public filings.

📋 Cogitanda, headcount indicators, pre- and post-insolvency, 2024–2025

Metric	Figure	Context
Total group employees (prelim insolvency)	~150	Secured through insolvency wage pre-financing to end of January 2025
Employees transferred (asset deal)	~70	Secured with the DGC asset transfer
DGC group headcount (post-acquisition)	>100	Group-wide across Flensburg and Cologne; not Cogitanda standalone

🏅 Competitive positioning. Within the broader cyber insurance landscape, Cogitanda aligns most closely with the European cyber MGA and services cluster — specialist underwriting design under delegated authority paired with cyber prevention, monitoring, and incident orchestration. US integrated cyber platform peers include At-Bay, Coalition, Corvus Insurance, Cowbell, and Resilience. European challengers with comparable profiles include Stoïk and Eye Security. Additional ecosystem peers span Baobab Insurance, BOXX Insurance, Converge Insurance, Elpha Secure, Emergence Insurance, Evolve MGA, Invision Cyber, Measured Analytics and Insurance, Onda, Pera, SafeInside Insurance, Sync Underwriting, and Dattak.

🏰 Competitive moat. Cogitanda's central differentiation claim rests on its integrated prevention, insurance, and incident management offering, supported by operational documents and acquisition communications. Distribution lock-in is indicated by broker onboarding and portal-driven configuration processes. Capacity access and continuity following insolvency, with two major risk carriers explicitly maintaining support post-acquisition, represents a key strategic asset for the reconstituted business.

📚 Market context. Academic and institutional research highlights structural challenges directly relevant to cyber MGA sustainability, including aggregation and systemic cyber risk, uncertainty around exclusions (especially war and attribution clauses), and the need for clearer coverage constructs and risk transfer mechanisms. These themes are especially pertinent given Cogitanda's reliance on external carriers and its emphasis on prevention and crisis management as risk-mitigating levers.

~*~

Risks and outlook

🔗 Capacity dependency. Cogitanda's model is strongly dependent on third-party risk carriers, and post-acquisition continuation explicitly depends on retained and newly arranged carrier support. Any withdrawal or non-renewal of delegated authority by a material capacity provider could directly affect production capability and portfolio continuity.

🌊 Systemic aggregation risk. Cyber risk is structurally prone to accumulation and systemic events that can affect multiple insureds simultaneously, a core constraint on cyber insurability that directly affects carrier appetite and delegated authority terms. This dynamic is amplified for specialist MGAs whose portfolios are concentrated in a single line of business.

⚔️ War exclusion disputes. War and state-sponsored cyber attribution remain a persistent stress point for cyber insurance coverage. The broader market dynamic and the documented presence of war clauses in comparable policy conditions create ongoing due diligence exposure for placement, claims handling, and reputational risk.

🔧 Integration risk. An asset deal typically requires re-establishing contracts, delegated authority agreements, systems, and controls under a new group governance model. The integration of security operations with insurer-facing processes suggests execution and compliance risk during the transition ramp-up.

👤 Key-person risk. The founder's death is repeatedly cited as a major destabilizing factor preceding insolvency, indicating historical dependence on key individuals and associated governance continuity risk.

🔭 Strategic outlook. Cogitanda's post-acquisition strategy centers on the combined "360°" proposition of risk prevention and monitoring paired with insurance and crisis management. Product communications signal a push toward digitized underwriting workflows (digital application process and structured cyber risk check) and tiered product architecture, reflecting a modernization trajectory under DGC ownership.

~*~

Timeline

• 2016 — Cogitanda is founded as an early specialized cyber insurance provider in Germany.
• 2019 (July) — Formal policy conditions for Cyber Pro+ (AVB Version 1.0, dated July 26, 2019) are established.
• 2023 — Sudden death of founder Jörg Wälder triggers economic difficulties for the group.
• 2024 — Cogitanda partners with Everest Insurance and IQUW to expand cyber capacity for mid-market clients in Germany and Austria.
• November 2024 — Insolvency filing by the group and appointment of a preliminary insolvency administrator; continuity of customer coverage is asserted.
• March 2025 — Asset deal sale to a DGC AG subsidiary closes; Cogitanda brand is retained and operations continue.
• 2025 onward — Public positioning emphasizes integrated cybersecurity and insurance, with launch of the CYBERPROTECTION product featuring a digital process and risk check.

~*~

See also

• Cyber insurtech MGAs and underwriting agencies

~*~