This is how it should work: supermarket wants to use high tech stuff such as connected fridges, they get a cyber insurance policy as part of all the other insurances they have. The insurer then has domain experts to figure out what the insured needs to do to meet a risk threshold (or they adjust fees accordingly).

This model has worked fine for many other types of risks.