To quote Brian Snow (former director of the Information Assurance Directorate of the US National Security Agency) at the end of his presentation at the AUScert 2008 security conference:

There is one other process going on now in the insurance industry that I think is great.  It’s putting the financial issue in the right place.  One of the most promising recent occurrences in the insurance industry was stated in the report of Rueschlikon 2005 (a conference serving the insurance industry).  Many participants felt that, and this is a direct quote:

‘The insurance industry’s mechanisms of premiums, deductibles, and eligibility for coverage can incent best practices and create a market for security . . .  This falls in line with the historic role played by the insurance industry to create incentives for good practices, from healthcare to auto safety . . .   Moreover, the adherence to a set of best practices suggest that if they were not followed, firms could be held liable for negligence.’

Bluntly, if your security product lacks sufficient robustness in the presence of malice, your customers will have to pay more in insurance costs to mitigate their risks.  Insurance is a recurring cost that business certainly try to manage.

Differential pricing based on quality of your security components, its coming.

I checked just before coming to this conference with a senior manager of Swiss Re, they are still on that path, and they are going to pull it off. (2008)

I think that is one of the greatest plugs that could possibly get going for us out there.  It’s great news.