Here's how I imagine it: The policy would insure up to a certain dollar amount, say $20 million, and pay directly to the insured in the event of an attack. If t

Here's how I imagine it: The policy would insure up to a certain dollar amount, say $20 million, and pay directly to the insured in the event of an attack. If the ransom demand is $50 million, the insured can either pay the remaining $30 million on their own or use the $20 million to begin to repair the damage to their systems.