This why I postulated "a new kind of cyber insurance" rather than what the industry has already cooked up.

The implication is: This new insurance would be legally obligated to actually fund stuff.