A sky-high premium may not always reflect your company’s security posture