What your law firm’s cyber insurance doesn’t cover