Cyber insurance isn't exactly driving organisations to improve their infosec practices, a think-tank has warned – and some insurers are thinking of giving up thanks to the impact of ransomware.