More like in the short term. A friend of mine just got a job at a SF startup for that. They're a consultancy which evaluates computer security for insurance companies, before they insure a business. She used to work on AI for intrusion detection, so they're hiring serious people for this.

There are specialty insurance companies which cover specific risks and know how to evaluate them. The classic is The Hartford Steam Boiler Insurance Company.[1] They were the first insurance company willing to insure steam boilers. About half their employees are boiler inspectors. When they started, in 1866, nobody else would touch that business.

They inspect before they insure. Typically, they send inspectors and provide the boiler owner with a to-do list. Then they come back to see if everything was fixed. Only then does HSB write a policy. Their policies give them the right to come in at any time and inspect. Which, randomly, they do.

Boring old Hartford Steam Boiler is expanding into computer systems insurance.[2] But they are not as hard-ass about inspections as they are with boilers, unfortunately. They know how to keep boilers from blowing up. Computer security isn't there yet.

[1] https://www.munichre.com/HSB/about-hsb/index.html

[2] https://www.munichre.com/HSB/cyber-insurance/index.html

> They're a consultancy which evaluates computer security for insurance companies, before they insure a business.

Can you share the name of the company?

But do audits show compliance with basic security practices, or compliance with PCI DSS and other standards which may be orthogonal to security?

In this case it would be the insurance company who requests the audit, so there would be incentives to ensure that the audits are meaningfully preventative.

Good point!

Insurance companies already do this but that's not the point at all. You can be the victim of a cyberattack even if you do everything right and the insurance company will refuse to pay out of it's tied to (perhaps with little evidence) to a state-funded attack.

It might well kill the use of open source and small-company software in business, in that the developers/management behind said code can't pay insurance companies to say that their code will pass audit. Microsoft and Oracle will pass with flying colors, of course.

Doubt it, there are a lot of PCI Compliant businesses that get audited with open source software in their systems. I'm sure they have a node_modules somewhere on their build server.

When you have an attack that moves from your servers to your desktop computers, you have a network issue, which would be covered in an audit to verify you properly segment your network instead of having it in one large broadcast domain.

It could just as well lead to better support models for contributions to fix and audit open source.

The open source model is benefiting too many businesses to just up and throw it out.