Even as the Sony Corp cyber attack laid bare the kinds of vulnerabilities that typically drive companies to buy insurance policies, the lack of a risk model for insurers means such protection is not always easy to get. Unlike earthquakes, tornadoes or even terrorism, there are no existing models to calculate how much a so-called "cyber hurricane," cutting across a swath of companies, could cost. Without that, insurers cannot be sure how much risk they can afford to underwrite.