Nice to Have or Have to Have? The Case for Cyber Insurance