Buying Cyber Insurance in an Imperfect Market