Failure to understand cyber risk leads to poor risk modelling.