The market for cybersecurity insurance is collapsing: https://www.theinformation.com/articles/companies-are-ditching-cybersecurity-insurance-as-premiums-rise-c

The market for cybersecurity insurance is collapsing: https://www.theinformation.com/articles/companies-are-ditching-cybersecurity-insurance-as-premiums-rise-coverage-shrinks https://www.theinformation.com/articles/companies-are-ditchi... but the OP's arguments also apply to insurance, yet businesses buy insurance every day. The difference is the fines and liability for data breaches are so paltry it is the rational thing to do not to invest in security. This can only change through legislative action. I wouldn't hold my breath.