Why WooCommerce store owners only buy security after getting hacked - and how I'm building around that

So here's something I've learned the hard way after years of fixing WordPress sites: you can't sell prevention. You just can't.

I've had this exact conversation dozens of times. Store owner says "eh, we're a small shop, who would hack us?" Six months later they email me in a panic - site's serving pharma spam, Google slapped a red warning on it, orders dropped to zero. Suddenly budget is not a problem.

It used to drive me crazy. Now I'm trying to build around it instead of against it.

My project is Guardfos - monthly security plans for WooCommerce stores (malware cleanup, hardening, off-site backups, monitoring).

The part I'm most curious about: instead of a sales page full of scary statistics, I lead with a free scanner. You paste your URL, it shows you what's actually wrong with your site. No signup. My bet is that someone looking at their own outdated plugins and exposed login page is 10x more likely to act than someone reading "43% of websites get hacked" for the hundredth time.

Anyone else selling something people only want after the disaster? Insurance, backups, monitoring, legal stuff... how do you get them before the panic?