4 ms·

Even as a Toyota fanboy (which this seems to be a 3rd party not Toyota directly) I agree with you that companies need to be held accountable because what we’re

Even as a Toyota fanboy (which this seems to be a 3rd party not Toyota directly) I agree with you that companies need to be held accountable because what we’re doing now (nothing) doesn’t seem to be working, however I’d caution you about just making this a financial liability for them and ask you to step back and think critically. If you make this a financial liability, they (any company) are going to purchase insurance like anything else and then offset that cost to the customer - so you’ll just end up paying for it anyway.

AbrahamParangi 2y ago
Toyota’s costs don’t determine the prices Toyota can charge, and if the expected costs of adding a widget exceed the benefits you can be fairly sure they won’t add the widget.
Dibby053 2y ago
Fine, in that case companies that take security seriously and/or have frugal data collection and retention policies will be more affordable than their competitors, since their premiums will be cheaper.
alephnerd 2y ago
OP isn't wrong, and even attackers price in insurance payouts in ransomware demands. Chubbs, AXA, and others are major players in the Cyber Insurance industry in 2024. We were going the right path with recent SEC regulations, but those are up in the air now with the Chevron deference decision.
bux93 2y ago
The insurers will cotton on to the fact that companies with good data protection practices, like data minimization and auditing+pentesting your suppliers, pose a lower risk, and they will price that into the insurance products. To companies taking out insurance, this can look like being denied coverage unless you have evidence of good practices. But criminal statutes for gross negligence would probably also help.
evilduck 2y ago
Insurability and a company's willingness to buy insurance depends on if courts or legislators make it a slap on the wrist that's just a cost of doing business or a real existential liability. Make the penalty steep enough and the only option is to stop the behavior.

AbrahamParangi 2y ago

Toyota’s costs don’t determine the prices Toyota can charge, and if the expected costs of adding a widget exceed the benefits you can be fairly sure they won’t add the widget.

Dibby053 2y ago

Fine, in that case companies that take security seriously and/or have frugal data collection and retention policies will be more affordable than their competitors, since their premiums will be cheaper.

alephnerd 2y ago

OP isn't wrong, and even attackers price in insurance payouts in ransomware demands. Chubbs, AXA, and others are major players in the Cyber Insurance industry in 2024. We were going the right path with recent SEC regulations, but those are up in the air now with the Chevron deference decision.

bux93 2y ago

The insurers will cotton on to the fact that companies with good data protection practices, like data minimization and auditing+pentesting your suppliers, pose a lower risk, and they will price that into the insurance products. To companies taking out insurance, this can look like being denied coverage unless you have evidence of good practices. But criminal statutes for gross negligence would probably also help.

evilduck 2y ago

Insurability and a company's willingness to buy insurance depends on if courts or legislators make it a slap on the wrist that's just a cost of doing business or a real existential liability. Make the penalty steep enough and the only option is to stop the behavior.