Yes and no. Businesses have cyber insurance policies. In a world of frequent ransomware attacks, many security policy changes have been mandated by insurance companies, and for legitimate reasons.

The attacks are not frequent enough. And the IT is already outsourced (because cheaper).