Insurers don't have a good way to measure their customers' cyber risk because because companies don't know how vulnerable they are.