The purpose of insurance is to transfer risk. Compliance with underwriting requirements or audits is not the same as security. If it’s cheaper to just check checkboxes, pay the ransom, and then hike next year’s premiums then they’ll do that.
The ransom is nothing.
For example, a policy might cover the cost of a crisis management PR team. Or it might cover the cost of rebranding, including corporate reorganization.
A wide ranging reputational risk policy can become very expensive, very fast.
https://advisorsmith.com/what-is-reputational-risk-insurance...