BOXX Insurance

BOXX Insurance
BOXX Insurance Inc.
Corporate identity
Type	Private — insurtech MGA, Lloyd's coverholder
License type	Managing general agent (MGA) Lloyd's coverholder U.S. insurance producer
NPN	20139876
Founded	2018 (2018)
Headquarters	Toronto
Licensed jurisdictions	Canada United States Europe (selective)
Ultimate parent	Zurich Insurance Group
Major shareholders	Zurich Insurance Group
Key people	Vishal Kundi (CEO, Co-founder) Mike Senechal (Co-founder) Neil Morrison (Board Chair) Jonathan Weekes (President, Canada) Philip Baker (Chief Underwriting Officer) Steve Penney (CTO) Neal Jardine (Chief Cyber Intelligence and Claims Officer) Jack Brooks (Head of Hackbusters and Virtual CISO)
Number of employees	36
Business & markets
Customer segments	SME commercial cyber Consumer/personal cyber Affinity partners
Lines of business	Cyber insurance Tech E&O Media liability Financial crime
Business segments	Business Household Partner/affinity
Main products & services	Cyberboxx Business 5.0 Cyberboxx Home Tech E&O by BOXX Cyberboxx Assist
Technology platform	Templarbit (cyber threat intelligence, acquired November 8, 2022 (2022-11-08))
Capacity providers	Certain Lloyd's Underwriters Boiler Inspection and Insurance Company of Canada (Munich Re) Hartford Steam Boiler
Distribution	Insurance brokers Partner/affinity channels (banking, insurance, retail/e-commerce, mobile operator/telco) App-based policy management
Geographic markets	Canada United States Spain Switzerland Dubai India
Customers served	close to one million (July 2025)
Competitors	At-Bay Coalition Corvus Insurance Cowbell Resilience Stoïk Eye Security
Key financials
Total funding raised	US$24.5 million
Last funding round	Series B, US$14.4M, January 31, 2023 (2023-01-31)
Lead investors	Zurich Insurance Group Zurich Insurance Company Ltd
Capacity partner ratings	A- or better

🏢 BOXX Insurance Inc. is a cyber-focused insurtech and managing general agent founded in 2018 and headquartered in Toronto, co-founded by Vishal Kundi (CEO, with approximately 20 years of global insurance experience) and Mike Senechal (a technology entrepreneur whose prior fintech venture was acquired by SoFi). The company operates under a delegated authority model as a licensed MGA and Lloyd's coverholder, underwriting, pricing, and selling cyber insurance policies while maintaining partnerships with external capacity providers including Lloyd's syndicates and Munich Re's Boiler Inspection and Insurance Company of Canada. Neil Morrison serves as Chair of the Board, with senior leadership including Jonathan Weekes (President, Canada), Philip Baker (Chief Underwriting Officer), Steve Penney (CTO), Neal Jardine (Chief Cyber Intelligence and Claims Officer), and Jack Brooks (Head of Hackbusters and Virtual CISO).

💰 Funding and ownership. BOXX raised a total of US$24.5 million in institutional venture capital across two rounds over approximately 16 months, with Zurich Insurance Group serving as lead investor in both: a US$10 million Series A in September 2021 (co-invested by Cyber Mentor Fund and SixThirty Ventures) and a US$14.4 million Series B in January 2023 led by Zurich Insurance Company Ltd. Zurich's relationship with BOXX evolved from a global collaboration announced in September 2021 emphasizing integrated cybersecurity and insurance for SMEs and consumers, through lead investment in both rounds, to a completed full acquisition on 3 July 2025 positioning the platform for global retail and SME cyber distribution. BOXX stated it would continue to operate as a standalone entity following the transaction, with capital strategy expected to shift from standalone venture financing to Zurich group priorities.

⚙️ Business model and economics. BOXX operates as an MGA retaining a fixed percentage of premiums collected to fund operations, with the remainder supporting claims and capital costs borne by its insurance backers under a standard delegated authority fee arrangement. The company serves three customer segments — SME commercial cyber, consumer and personal cyber, and affinity and partner-distributed business — with the disclosed customer mix of hundreds of thousands of individuals and close to one million total customers structurally consistent with a material embedded, affinity, and consumer component alongside the commercial book. Distribution flows primarily through insurance brokers and partners, supplemented by app-based policy management and claims filing for certain plans, and corporate partner solutions targeting banking, insurance, retail and e-commerce, and mobile operator and telco verticals.

📦 Product architecture. The core product suite includes Cyberboxx Business 5.0 (a modular, claims-made cyber, data, and privacy policy with first-party modules spanning incident response, cyber extortion, data recovery, bricking, business interruption variants, reputation protection, and key-person cover, plus third-party modules covering privacy liability, regulatory defence, PCI DSS, media, and network security, and financial crime modules for social engineering), Cyberboxx Home (personal cyber insurance plus Equifax identity and credit monitoring, underwritten by Munich Re's BIIC, with illustrative CAD $25,000 limits across cyber attack, fraud, bullying, data breach, and home title recovery), and Tech E&O by BOXX (encompassing professional E&O, technology E&O, technology products liability, technology discrimination liability, first-party cyber modules, and financial crime coverage including invoice manipulation). Cyberboxx Business uses modular declarations so coverage applies only for insuring agreements with a stated limit, and both the Cyberboxx Business and Tech E&O specimens include Lloyd's-signed war and cyber operation endorsements with attribution frameworks referencing specified states and impacted state definitions. Underwriting signals collected at application include last-12-month gross revenue, employee count, desired cyber limit, and disclosure of higher-risk activities such as adult content, cannabis, cryptocurrency, data aggregation, debt collection, managed IT, payment processing, and gambling.

🛡️ Cybersecurity services layer. BOXX differentiates through an integrated prevention-led services model encompassing pre-bind support (external attack surface and vulnerability monitoring, security-control posture data collection on MFA, backups, patch cadence, and EDR) and in-force services (real-time threat monitoring, dark web hacker chatter surveillance, external attack surface monitoring, actionable alerts, and vendor discounts for EDR, XDR, MFA, and cloud backup tooling). The Hackbusters incident response unit engages before a claim is filed, providing continuous scanning, dark web monitoring, and up to three hours of free assurance and guidance before the client needs to consider filing a formal claim. The November 2022 acquisition of Templarbit, a Palo Alto-based cyber threat intelligence platform focused on vulnerability identification across digital assets, internalized proprietary threat intelligence capabilities rather than relying purely on third-party tooling, with the acquired company's founder joining BOXX Labs.

🌐 Distribution and geographic footprint. BOXX operates across Canada and the United States with selective products and collaborations in Europe and other regions, maintaining reported office locations in Toronto, Miami, Zurich, Dubai, and Mumbai. U.S. market entry was formally announced in October 2021 with the appointment of Hilario Itriago as President of BOXX USA, and the U.S. entity BOXX Insurance LLC holds National Producer Number 20139876 with registrations across multiple states as an insurance producer. European partnerships include the AXA collaboration launched in Spain in January 2024 for small business cyber risk prevention (featuring perimeter scanning, dark web monitoring, employee awareness training, and an instant response wallet) and a personal cyber product partnership with Zurich in Switzerland announced in May 2024.

🏦 Capacity providers and partnerships. Both Cyberboxx Business and Tech E&O policy specimens contain endorsements signed on behalf of Certain Lloyd's Underwriters, confirming Lloyd's participation as a capacity provider, while Cyberboxx Home is separately underwritten by the Boiler Inspection and Insurance Company of Canada, a Munich Re company, and BOXX states its insurance partners are rated A- or better referencing backers including Munich Re and Hartford Steam Boiler. The Equifax partnership embeds identity and credit monitoring services into the Cyberboxx Home product, and in India BOXX supports Housing.com customers with cyber protection as a partner distribution example. The licensing framework combines U.S. producer licensing at the entity level, Lloyd's capacity access via coverholder arrangements, and local admitted carrier underwriting for certain Canadian personal cyber cover.

📈 Operational scale and competitive positioning. BOXX disclosed protecting over 250,000 individuals and 10,000 businesses as of January 2023 with a headcount of 36 (up from 5 in the preceding year), and by July 2025 had scaled to close to one million total customers across five continents. Within the cyber insurtech MGA ecosystem including peers such as At-Bay, Coalition, Corvus, Cowbell, Resilience, Stoik, and Eye Security, BOXX clusters most closely with prevention-led cyber insurance plus security services platforms but stands out by maintaining a visible personal and household cyber line alongside SME and partner-distributed offerings. Post-acquisition integration into Zurich's platform via Zurich Global Ventures is expected to strengthen distribution access and long-term capacity stability relative to standalone MGAs.

⚠️ Risk factors and outlook. Key structural risks include capacity dependency inherent to the coverholder and MGA model exposing BOXX to repricing, underwriting authority constraints, and performance management tightening by capacity providers, alongside systemic cyber aggregation risk illustrated by the war and cyber operation endorsements in policy specimens addressing state-linked cyber events. Regulatory complexity across multi-jurisdictional privacy breach response and defence regimes will intensify as BOXX scales internationally, while acquisition integration execution risk persists around product integration, distribution alignment, and technology platform consolidation under Zurich ownership with limited disclosed post-close operational detail. Maintaining service quality across the Hackbusters response unit, virtual CISO guidance, and continuous monitoring infrastructure at scale is cost-intensive and operationally complex as the customer base approaches seven figures, though Zurich's balance sheet and global infrastructure may mitigate standalone resource constraints.

The following sections provide further details.

~*~

Corporate and regulatory profile

🏢 Founded and headquartered. BOXX Insurance Inc. is a cyber-focused insurtech and managing general agent (MGA) founded in 2018 and headquartered in Toronto. Zurich Insurance Group completed the acquisition of BOXX on 3 July 2025, positioning the company to provide retail and SME cyber insurance and services on a global basis. BOXX stated it would continue to operate as a standalone entity following the transaction.

🔧 Delegated authority model. BOXX operates as a licensed MGA and Lloyd's coverholder under a delegated authority model, meaning it underwrites, prices, and sells policies, manages renewals, and maintains partnerships with capacity providers. Public materials emphasize the MGA/coverholder framework using third-party insurer capacity rather than a proprietary licensed carrier balance sheet.

📋 U.S. and Lloyd's licensing. The U.S. entity, BOXX Insurance LLC, holds National Producer Number (NPN) 20139876 and is registered across multiple states as an insurance producer. BOXX publicly asserts Lloyd's coverholder status, and its policy wordings include endorsements signed on behalf of Certain Lloyd's Underwriters, confirming Lloyd's capacity participation.

~*~

Leadership and governance

👤 Co-founders. BOXX was co-founded by Vishal Kundi and Mike Senechal. Kundi serves as CEO and brings approximately 20 years of experience in global insurance corporates. Senechal's career has been centred in technology; he built a software development company and co-founded a fintech firm subsequently acquired by SoFi.

👥 Senior leadership. Key officers identified in public materials include Jonathan Weekes (President, Canada), Philip Baker (Chief Underwriting Officer and policy signatory), Steve Penney (CTO), Neal Jardine (Chief Cyber Intelligence and Claims Officer), and Jack Brooks (Head of Hackbusters and Virtual CISO).

🪑 Board chair. Neil Morrison is listed as Chair of BOXX Insurance Inc. in Aviva plc AGM materials.

~*~

Ownership, funding, and capitalization

💰 Venture financing. BOXX raised a total of US$24.5 million in institutional capital across two rounds over approximately 16 months, with Zurich Insurance Group serving as lead investor in both.

💵 BOXX Insurance — venture funding rounds (USD millions)

Round	Date	Amount raised	Lead investor	Notable co-investors	Cumulative funding
Series A	2021-09-22	US$10.0M	Zurich Insurance Group	Cyber Mentor Fund; SixThirty Ventures	US$10.0M
Series B	2023-01-31	US$14.4M	Zurich Insurance Company Ltd	—	US$24.5M

🤝 Zurich collaboration arc. Zurich initially described its relationship with BOXX as a global collaboration emphasising integrated cybersecurity and insurance solutions for SMEs and consumers, announced in September 2021. Zurich subsequently led the Series B in January 2023, and the relationship culminated in the full acquisition completed in July 2025. Following the acquisition, BOXX's capital strategy is expected to be driven by Zurich group priorities rather than standalone venture financing.

~*~

Business model, customer segments, and product architecture

⚙️ MGA economics. BOXX retains a fixed percentage of premiums collected to operate the business, while the remainder of premium supports claims and capital costs borne by its insurance backers — a standard MGA-style fee arrangement.

👥 Customer segments. BOXX is positioned across SME commercial cyber and consumer/personal cyber, and also distributes through affinity partners. As of January 2023, the company reported protecting over 250,000 individuals and 10,000 businesses. By the time of the July 2025 acquisition announcement, BOXX stated it had rapidly scaled to serve close to one million customers across five continents. The product suite spans offerings for businesses, households, and partner/affinity channels.

📊 Segment mix inference. The disclosed customer counts — hundreds of thousands of individuals and close to one million total customers — are structurally consistent with a material embedded/affinity and consumer component, because SME-only cyber MGAs typically require exceptionally large broker penetration to reach comparable customer volumes at commercial policy price points.

🏗️ Underwriting signals. The Cyberboxx Business application collects data including last-12-month gross revenue, employee count, and desired cyber limit. The Tech E&O application flags certain higher-risk activities for disclosure, including adult content, cannabis, cryptocurrency/blockchain, data aggregation, debt collection, managed IT services, payment processing, and gambling — reflecting a cyber and tech E&O underwriting posture sensitive to elevated digital risk classes.

~*~

Insurance products and cybersecurity services

📦 Core product lines. BOXX markets an integrated model across cyber insurance and security services for businesses and households, supplemented by a tech E&O line. Key named products include Cyberboxx Business 5.0 (cyber, data, and privacy insurance), Cyberboxx Home (personal cyber insurance plus assistance), Tech E&O by BOXX (E&O, media, and cyber insurance), and Cyberboxx Assist (a tools and services layer for business and home customers).

📝 Cyberboxx Business 5.0. The Cyberboxx Business policy is written on a claims-made and reported basis and is modular: coverage applies only for insuring agreements for which a limit appears in the Declarations, meaning modules may be elective or tiered. First-party coverages include incident response costs (legal, forensics, notification, call centre, credit monitoring, identity monitoring, and public relations), cyber extortion, data recovery, bricking, business interruption (including contingent and system-failure variants), reputation protection, and key-person cover. Third-party coverages include information privacy liability, regulatory defence and awards, PCI DSS liability, media liability, and network security liability. The policy also incorporates financial crime modules covering social engineering and client social engineering loss.

⚔️ Notable exclusions. Cyberboxx Business includes a war and cyber operation endorsement referencing "Specified States" and defining "Impacted State," signed on behalf of Lloyd's. Additional exclusions address intellectual property in manufacturing/import/design/packaging contexts, unlawful biometric data collection, discrimination, and insured-versus-insured scenarios.

🏠 Cyberboxx Home. Cyberboxx Home is positioned as personal cyber insurance plus assistance, underwritten by the Boiler Inspection and Insurance Company of Canada, a Munich Re company. The product includes membership benefits tied to Equifax identity and credit monitoring services.

🏡 BOXX Insurance — Cyberboxx Home illustrative policy limits (CAD)

Coverage module	Limit
Cyber attack	$25,000
Cyber fraud	$25,000
Cyber extortion	$2,500
Cyber bullying	$25,000
Data breach	$25,000
Home title recovery expenses	$25,000

💼 Tech E&O by BOXX. The Tech E&O wording encompasses E&O, media, and cyber insurance, with third-party insuring agreements extending beyond pure cyber to include professional E&O, technology E&O, technology products liability, and technology discrimination liability. The policy also contains first-party cyber modules (incident response, extortion, data recovery, business interruption variants) and financial crime modules including invoice manipulation and social engineering of key personnel. A war and cyber operation endorsement in the Tech E&O specimen includes an attribution framework with an explicit carve-back for certain impacts on systems not physically located in an impacted state, signed on behalf of Certain Lloyd's Underwriters referencing a Unique Market Reference Number.

🛡️ Pre-bind and continuous services. BOXX's service layer encompasses pre-bind underwriting support, including external attack surface and vulnerability monitoring, and collection of security-control posture data (MFA, backups, patch cadence, EDR) during the application process. For in-force business policyholders, Cyberboxx Business provides real-time threat monitoring, dark web "hacker chatter" surveillance, external attack surface monitoring, actionable alerts, and vendor discounts for security tooling (EDR, XDR, MFA, cloud backups).

🚨 Hackbusters incident response. Hackbusters is positioned as support that can engage before a claim is filed, including continuous scanning and dark web monitoring. The service provides free assurance and guidance up to a threshold of three hours before a client needs to consider filing a claim. For consumer customers, Cyberboxx Assist for Home provides identity monitoring via breach scans, security assessments, guided assistance, and 24/7 incident response support.

🧠 Templarbit acquisition. In November 2022, BOXX acquired Templarbit, a Palo Alto–based cyber threat intelligence platform focused on vulnerability identification across digital assets, to strengthen proactive cyber risk protection capabilities. The acquired company's founder joined BOXX Labs.

~*~

Distribution, licensing, and geographic footprint

🌐 Distribution architecture. Policies are primarily sold through insurance brokers or partners, with certain plans enabling customers to manage policies and file claims via an app. BOXX also offers solutions for corporate partners in banking, insurance, retail/e-commerce, and mobile operator/telco verticals as part of its partner and affinity distribution strategy.

🗺️ Geographic presence. BOXX operates in Canada and the United States, with selective products or collaborations in Europe and other regions. Reported office locations include Toronto, Miami, Zurich, Dubai, and Mumbai. U.S. market entry was formally announced in October 2021 alongside the appointment of Hilario Itriago as President of BOXX USA.

🇪🇺 European partnerships. In Spain, BOXX partnered with AXA to launch a cyber risk mitigation solution for small businesses in January 2024. In Switzerland, BOXX announced a personal cyber product partnership with Zurich Insurance Group in May 2024.

📜 Licensing approach. BOXX's regulatory framework combines U.S. producer licensing at the entity level, Lloyd's capacity access via coverholder arrangements evidenced by policy endorsements signed on behalf of Lloyd's underwriters, and local admitted carrier underwriting for at least certain Canadian personal cyber cover through the Boiler Inspection and Insurance Company of Canada.

~*~

Capacity providers, partnerships, and AXA relationship

🏦 Lloyd's and admitted capacity. Both the Cyberboxx Business and Tech E&O policy specimens contain Lloyd's-signed endorsements, confirming Lloyd's participation as a capacity provider for those product lines. Cyberboxx Home is separately underwritten by the Boiler Inspection and Insurance Company of Canada (Munich Re). BOXX states its insurance partners are rated A- or better and references backers including Munich Re and Hartford Steam Boiler.

🔗 Strategic partnerships. Zurich's involvement with BOXX evolved from a global collaboration announced in September 2021, through lead investment in both venture rounds, to completed acquisition in July 2025. The Templarbit acquisition in November 2022 internalised cyber threat intelligence and attack surface capabilities. Cyberboxx Home embeds identity and credit monitoring services through a partnership with Equifax. In India, BOXX supports Housing.com customers with cyber protection as a partner distribution example.

🅰️ AXA partnership. A direct partnership between BOXX and AXA, evidenced through a January 2024 press release, centres on a cyber risk mitigation solution for small businesses. The solution includes external perimeter scanning with a cyber risk score and peer benchmarking, 24/7 dark web monitoring and compromised credential alerts, employee awareness training with digital risk assessments, and an "instant response wallet" for post-breach guidance. The initial launch geography was Spain, and the announcement included remarks attributed to Alfonso Zayas Satrustegui of AXA Seguros España.

~*~

Competitive positioning, performance signals, and risk factors

📈 Operational scale. BOXX disclosed the following operational milestones: as of January 2023, over 250,000 individuals and 10,000 businesses protected; staff growth from 5 to 36 employees in the preceding year; and by July 2025, close to one million total customers served.

📊 BOXX Insurance — disclosed operational metrics

Metric	As of date	Figure	Source
Individuals protected	January 2023	>250,000	Series B announcement
Businesses protected	January 2023	>10,000	Series B announcement
Total customers	July 2025	~1,000,000	Acquisition announcement
Headcount	January 2023	36	Series B announcement

🏰 Competitive moat. BOXX is best characterised as a prevention-led cyber MGA operating across consumer and SME segments with embedded service delivery and partner distribution. Key differentiators include 24/7 incident response access without immediate claim filing, vCISO guidance, and continuous monitoring (dark web, password leaks, attack surface). The Cyberboxx Business wording includes a comparatively expansive set of first-party, third-party, and financial crime modules, positioning the product closer to a "cyber plus crime" package. The Templarbit acquisition supports an argument for proprietary threat intelligence capabilities rather than pure reliance on third-party tooling. Post-acquisition integration into Zurich's platform strategy via Zurich Global Ventures is likely to strengthen distribution access and long-term capacity stability relative to standalone MGAs.

🌍 Peer context. Within the cyber insurtech MGA ecosystem — which includes peers such as At-Bay, Coalition, Corvus Insurance, Cowbell, Resilience, Stoïk, and Eye Security, among others — BOXX clusters most closely with "cyber insurance plus security services" platforms. BOXX stands out by maintaining a visible personal/household cyber line alongside SME and partner-distributed offerings, as evidenced by its published customer counts and explicit household product documentation.

⚠️ Risk factors. Several structural risks merit attention:

• Capacity dependency: As a coverholder/MGA reliant on external insurer paper, BOXX is exposed to capacity repricing, underwriting authority constraints, and performance management tightening.
• Systemic cyber aggregation: War and cyber operation endorsements in policy specimens illustrate ongoing market tightening and potential coverage disputes in state-linked cyber events, a structural portfolio risk for cyber MGAs.
• Regulatory complexity: Products contemplate privacy breach response, regulatory defence, and cross-jurisdiction considerations, implying compliance complexity as BOXX scales internationally.
• Acquisition integration: Execution risk remains around product integration, distribution alignment, and technology platform consolidation under Zurich ownership, with limited disclosed post-close operational detail.
• Services scalability: Maintaining service quality (vCISO, Hackbusters response, monitoring) at scale is cost-intensive and operationally complex as customer counts approach seven figures.

~*~

Company timeline

📅 BOXX Insurance — corporate timeline

Date	Event
2018 (2018)	Company launched.
2020 (2020)	Founders discuss building a cyber-focused insurtech with a broker-centric digital platform experience.
September 22, 2021 (2021-09-22)	Series A of US$10M announced; investors include Zurich, Cyber Mentor Fund, and SixThirty Ventures.
October 1, 2021 (2021-10-01)	U.S. expansion announced; Hilario Itriago appointed President of BOXX USA.
November 8, 2022 (2022-11-08)	Acquisition of Templarbit announced; founder joins BOXX Labs.
January 31, 2023 (2023-01-31)	Series B of US$14.4M led by Zurich; company reports 250,000+ individuals and 10,000+ businesses protected; headcount reaches 36.
January 30, 2024 (2024-01-30)	Partnership with AXA to launch cyber risk prevention solution for small businesses, initially in Spain.
April 17, 2024 (2024-04-17)	Cyberboxx Business 5.0 product release announced.
May 2024 (2024-05)	Personal cyber product partnership with Zurich announced in Switzerland.
July 3, 2025 (2025-07-03)	Zurich completes acquisition of BOXX; BOXX states it will operate as a standalone entity post-transaction.

~*~