As an infosec practitioner, I can’t tell you how many times I’ve seen someone have insurance and their security posture be effectively nothing, or the insurance not pay out even with reasonable measures in place. Market failure in my opinion, needs more regulation.