To be fair, if using insurance and risking being hacked anyway has a higher expected net payoff than implementing a given set of security measures, then you may

To be fair, if using insurance and risking being hacked anyway has a higher expected net payoff than implementing a given set of security measures, then you may be financially incentivized (or legally beholden to your shareholders) to take the risk, get hacked and pay any fines if it gets discovered. The security literature refers to it as "risk transference". Chances are your company ultimately exists to optimize for shareholder value