How cookie cutter cyber insurance falls short