The increasing question organisations face with cyber risk insurance is no longer ‘should we purchase’, but ‘can we get it?’