@Petre Peter
What's important has to be measurable because I can only manage what I can measure.
That's a poor approach to management. It's the kind of limited thinking that can be automated away. A good counterexample is crisis management, where the ability to "measure" inputs and outputs is often uncertain in the moment.
@Anders
There's no insurance against 0day.
There is: use a system that isn't affected. Anyone compiling actuarial tables can surely tell you which technologies to avoid. My bet is that, with some irony, most insurance companies themselves have IT departments that impose systems with a terrible track record when it comes to cybersecurity.
1b9da6947f66f33615a04b3b2fab44667df651d204b4b57e4cd1c851070315d9