Cybersecurity borrows many insurance models and analogies in an attempt to manage risk. However, this can be dangerous if assumptions are not fully understood.