“Cyber insurance is an investment, not an expense”