Does cyber risk management need a rethink.