Closing the gap between cyber security and cyber insurance