A majority of the insurance industry has strong cybersecurity practices, but is lacking in some areas.