Does the lack of case law make cyber insurance difficult to accurately underwrite?