One would hope that insurers would start proactively setting the rates for their policies based on several factors and not just in response to breaches and payo

One would hope that insurers would start proactively setting the rates for their policies based on several factors and not just in response to breaches and payouts. For instance, an insurers exposure would be greatly affected by the types of information collected, so they could offer a lower costs to a business that was only collecting email addresses than to one that collected many more types of PII. You'd also hope that insurers would start to give preferential rates to companies that complete (and resolve) periodic security audits from trusted auditors. The benefits of insurers getting involved is that they can de facto mandate these kinds of security audits and practices by making insurance policies unaffordable without them. And, unlike government regulation, the requirements from insurers can evolve rapidly over time in a way that's difficult for laws to evolve. Insurers will hire security experts to advise on best practices and each have their own ideas of what security means. If a business finds a single security practice onerous, they can shop for an insurer that doesn't require it.