This is where I've been predicting the insurance side of cybersec going for a while. You have some baseline required security for the premium that offers X cov

This is where I've been predicting the insurance side of cybersec going for a while. You have some baseline required security for the premium that offers X coverage, and you can reduce the premium or increase the coverage if you can prove Y standards have been met. Get a list of approved 3rd party auditors/pentesting companies, have them certify what level your company is at, apply appropriate discount. Insurance costs are a language that businesses speak fluently, so I think this has a higher chance of moving the needle on cybersecurity standards and have them actually be implemented across the board.