There's massive room in the market for a security-first company that offers insurance as a guarantee.

This company would essentially operate as the security team for clients and put in contractually enforced policies and follow through on implementation. If a client decides to not implement required security practices, then their policy immediately gets dropped.

This is the only scalable way I'd see to implement real insurance against cyber-attacks.