Generally these insurance policies have requirements or cluases for things like training staff on good security practices, documenting that this training happen

Generally these insurance policies have requirements or cluases for things like training staff on good security practices, documenting that this training happened. Helps to lower exposure to lawsuit (ie we weren't negligent). I know of one insurer that requires companies to place a hardware device that blackholes dns in front of the customers network. Things like this really help to lower exposure to attackers. I'm surprised black hole dns isn't more common.