That would create an even more parasitic security industry than we already have. As many have said that the only defense against data extraction of personal in

That would create an even more parasitic security industry than we already have. As many have said that the only defense against data extraction of personal information is to not collect them. I think this collection has to become more expensive than the benefits to marketing and advertising. Insurance might help here, but I expect premiums to be high if risk is adequately and realistically assessed. Against exploits like the log4j thing... the library is popular and was used for years. In open source and commercial software alike. I doubt any audit would have found the problem. Most probably didn't expect it in such a library in the first place and would have started review with the more arcane dependencies. The only benefit of other components is probably security through obscurity. But what would you insure against here? Against exploits in software in general? I don't think that would improve software security in the long run.