Scanners produce reports. Insurance needs witnesses.

The AI-supply-chain cohort is already crowded: Invariant, Snyk Agent Scan, JFrog, Klaimee, a dozen more. They all ship the same artifact, a point-in-time report. That is not what underwriters can price against. The primitive insurance needs is a falsifiable attestation with a TTL that re-verifies on drift. Nobody ships that yet.