Insurance does actually tend to put cybersecurity requirements on to businesses they insure, the problem is that it's pretty hard to write cybersecurity requirements that actually result in secure IT systems as opposed to just a bunch of compliance work.