Perhaps it's indeed time for serious companies (these are definitely not MVPs) to have security insurance and they'd mandate some standard.