https://www.sans.org/reading-room/whitepapers/riskmanagement/quantifying-risk-closing-chasm-cybersecurity-cyber-insurance-36770