Interesting concept. Use a rating system like bond ratings to evaluate cybersecurity. Companies that depend upon others having a good rating could then know not to do business with those companies with bad ratings.