Ask HN: How are cyber security insurance primes calculated?

I wonder how the primes for cyber security insurances are calculated. I have seen some publications to model things such as how computer infections spread with similar techniques used in epidemiology but I feel that is a pretty specific case that does not cover all what big corporations need. Also I am thinking that maybe the lack of data makes it hard to calculate accurate expected losses, which at the same time may give the insurance companies some freedom to simply inflate the primes. BTW, I have no idea about insurances or cyber security so it just might be a stupid question.