I was of the understanding that cyber insurance wouldn't pay out if you were found to have taken less than adequate measures to protect your data assets.
A bit like home insurance, having it doesn't excuse you from having to lock your doors when you're out.
Biting the hand that feeds IT
