You're so right. Pay us ludicrous sums to make your auditors feel good. Crazy.

So much of regulation is just a round-about to creating business for regulatory compliance.

Good for profits, but it bet there are some employees who feel a distinct lack of joy about their work.

It's not about checking the boxes themselves, but the shifting of liability that enables. Those security companies are paid well not for actually providing security, but for providing a way to say, "we're not at fault, we adhered to the best security practices, there's nothing we could've done to prevent the problem".

So in essence just a flavor of insurance?

Shouldn't that hit Crowdstrike's stock price much more than it has then? (so far I see ~11% down which is definitely a lot but it looks like they will survive).

Not quite. Insurance is a product that provides compensation in the event of loss. Deploying CrowdStrike with an eye toward enterprise risk management falls under one of either changing behaviors or modifying outcomes (or perhaps both).

They are paying with reputation and liability, no?

If the idea is "we'll hire Crowdstrike for CYA" when things like this happen, the blame is on CS and they pay with their reputation.

Pay for what exactly though? Cybersecurity incidents result in material loss, and someone somewhere needs to provide dollars for the accrued costs. Reputation can't do that, particularly when legal liability (or, hell, culpability) is involved.

EDR deployment is an outcome-modifying measure, usually required as underwritten in a cybersecurity insurance policy for it to be in force. It isn't itself insurance.

Not at all like insurance, because they don’t have to pay out at all when things go wrong.

In a way it's the new "nobody ever got fired for buying IBM".