A qualitative assessment like whether Company A is more likely to be breached than Company B is a good start, but it's a far cry from being able to actually qua

A qualitative assessment like whether Company A is more likely to be breached than Company B is a good start, but it's a far cry from being able to actually quantify each of their expected losses. I agree that there's a big disconnect between the way that insurers assess risk and the way that security researchers assess risk. But I'm skeptical that the type of assessment you're describing can be done at scale in a rigorous enough way to inform pricing decisions, I worry that it would just turn into gameable checklists and therefore cease to be a good measure. Perhaps more importantly, it's probably possible for insurers to accurately assess the expected annual cost associated with a given company's employees getting phished for a seven-digit ransom, but that's not the only risk they're worried about. Even if it can accurately assess the average loss associated with, say, a major 0day in a particular piece of software that's used by a double-digit percentage of companies - a much harder task - an insurer might just not want that much exposure to a single point of failure on its balance sheet.