Data-driven cyber underwriting