Aligning cyber risk with cyber insurance