What's the current state of insurance protection for things like DDoS
attacks or other unbudgeted outages, and does anybody actually use it?

"Given the choice between buying excess bandwidth/hardware/service versus
paying an insurance premium that will likely cover spikes in such costs
whenever they are needed, [insert comment here]."

This is for my own use. Off-list is fine.