When the Insurance Industry Can't Price the Risk, Someone Builds a Better Model

Every few years, an entire industry discovers it has been flying blind.

For European cyber insurance, that moment came when loss ratios across the continent turned ugly. Carriers were paying out more in claims than they were collecting in premiums — not because cyber risk was uninsurable, but because nobody had built the infrastructure to understand it accurately. Underwriters were pricing million-dollar exposures based on self-reported questionnaires.

Vincenz Klemm had spent five years building an insurtech in Silicon Valley before returning to Europe. What he found was a market with three compounding failures and no one addressing all three simultaneously. In a recent episode of BUILDERS, the CEO and Co-Founder of Baobab walked through exactly how he approached it.

The Three-Problem Diagnosis

Most founders identify one pain point and build toward it. Vincenz mapped three before writing a line of code — and the real insight was recognizing they were structurally connected.

The first was customer-facing: insurance products offered protection after a breach but did nothing to prevent one. The second was economics: "These insurance products were not profitable... the insurance companies had trouble in really understanding the risk." The third was distribution: the broker channel controlling access to commercial buyers lacked the technical literacy to confidently sell cyber, and was quietly stepping back from deals it didn't feel equipped to close.

These three failures weren't independent. Accurate risk understanding enables profitable pricing. Preventing breaches reduces claims. Technically equipped brokers close deals they'd otherwise avoid. Baobab's model was designed to address all three through a single compounding mechanism.

Building the Risk Model From the Outside In

Baobab's underwriting process starts before a policy is written. The company maps the external attack surface of every company it considers insuring — exposed APIs, open databases, leaked credentials on the dark web, misconfigured assets visible from the public internet.

What they find is consistently surprising to customers. "We oftentimes find credentials clearly written in the code... we found webcams of a whole factory and offices that are just openly accessible security cameras." Vincenz notes that most standard security scanners miss this class of exposure entirely because they scan for categorized vulnerabilities — a developer leaving credentials in deployed code doesn't fit a known signature.

This reconnaissance feeds an AI model that correlates surface patterns with historical breach data across their book of business, identifying the most probable attack vectors for each specific company. The output is then handed directly to the customer — not as a retention tactic, but because the incentive structure demands it.

"Our incentive is that we don't have to pay out if you get hacked." Every prevented breach is a claim that never materializes. That alignment is also Baobab's most credible sales message: unlike a consultant billing by the hour, Baobab has no business flagging problems that don't matter.

The Channel Nobody Wanted to Disrupt

One of the more deliberate decisions Baobab made was to go deeper into the broker channel rather than around it. Commercial insurance buyers at mid-market and enterprise scale don't shop for coverage independently — they delegate to brokers who manage their entire risk portfolio, often across decades of relationship. That trust isn't easily replicated by a new entrant.

"The broker really has the trust of the customer to manage the insurance of the company on their behalf." Rather than treat that as a barrier, Baobab built tools and technical education to make underprepared brokers effective at selling cyber — converting a channel weakness into a distribution advantage that compounds over time as those brokers close deals they previously avoided.

What Moving Upmarket Actually Requires

Baobab started insuring companies from zero to €100 million in revenue. They pushed that ceiling to €500 million, then €1 billion. What reads as a sales strategy shift was actually a simultaneous rebuild of product, process, and internal expertise.

At enterprise scale, buyers aren't generalists. "Quite large companies oftentimes have professional insurance buyers... they know exactly every clause." These are former brokerage professionals who negotiate deductible structures, coverage limits, and individual policy terms with precision. The existing product couldn't support that level of configurability.

"We had to create the product in a bit more flexible way... to also give brokers different clauses that they want for their customers." Three things had to change in parallel: the product needed configurable clause architecture, the team needed people who could negotiate at that level, and the sales cycle had to accommodate a fundamentally different buyer. Founders treating upmarket as a pricing adjustment typically discover the hard way that it's an organizational one.

The Talent Moat

Baobab's hiring challenge can't be solved by compensation alone. The company needs people from two professional cultures that almost never intersect: cybersecurity, where the threat landscape reinvents itself every few years, and commercial insurance, where expertise accumulates over decades of relationship, legal precision, and institutional trust.

Vincenz is direct about why this is defensible: "I don't think that the likes of Allianz are particularly good at it... and I don't think that CrowdStrike can attract people from this conservative insurance world so well and basically create a culture that works for both equally."

The mechanism Baobab uses internally to hold that culture together is worth noting. Every employee carries what Vincenz calls an "obligation to dissent" — not just the right to raise a contrary view, but the requirement to do so when they can substantiate it. In a company where two expert cultures need to challenge each other productively, that norm isn't a culture perk. It's an operating necessity.

What's Next

Baobab expanded into the Netherlands and Belgium at the end of 2024, with broader European markets ahead. A new cybersecurity product suite — extending from outside-in attack surface monitoring to active internal network data feeds and deeper dark web research — is set for announcement in the coming months.

The structural problem Vincenz identified hasn't been solved at the industry level. Cyber risk is expanding faster than most carriers can model it. The companies that build proprietary data infrastructure to understand it accurately won't just underwrite better — they'll define what the category looks like for the next decade.