You can probably trust startup executives with digesting nuanced security advice; again I do similar consulting. It's also a fact that insurance companies are t

You can probably trust startup executives with digesting nuanced security advice; again I do similar consulting. It's also a fact that insurance companies are targeted less than <a lot of things>. If you're auditing startup insurance fintechs in that case, the PII they have and platform exposure to all the APIs they are pulling from or pushing too (a) looks a lot like a crypto company spanning web2/web3, and (b) puts them square in the target of software supply chain hacks. An attacker cares about <insurance startup>, but they do care about attacking the Equifax API that the insurance startup has an integration with. Excluding the crypto companies that do their own custody or run their own smart contracts, their risk profile and why ends up looking a lot like the fintech insurance startup haha.