Three can be addressed by requiring security audits. Historically the Big 4 have done them for SOX compliance or other reasons, but its becoming much more rout

Three can be addressed by requiring security audits. Historically the Big 4 have done them for SOX compliance or other reasons, but its becoming much more routine for internal purposes. There is no reason it couldn't expand to external users (insurance companies). Many accounting firms are already doing them for hospital boards, etc. Just like financial audits (or lack thereof) determine your loan rates in a SMB business, a security audit will do likewise.