Insurance for cyber incidents usually only cover you if you took reasonable measures. Like not exposing your internal systems to the Internet.