Insurance and derivatives are supposed to find prices for rare events. And if an organization can't insure or securitize a risk it should make them think real hard about mitigation.