I'm surprised companies don't buy insurance against this. I could very easily see insurance companies offering a new product. Pay us $25,000 a year, for a 5 million liability. Or 50,000 a year for a 10 million dollar liability shield etc.

Insurance companies can then develop their own methods to better determine premiums for companies based on measures they take.

Companies can then decide how much risk to take in choosing not to invest in cyber security for their operations based on the cost of their premiums.

If this is an insurance option that currently exists, perhaps more companies will begin paying for it.