The challenge is that cyber exposures vary greatly from one entity to the next. To meet the challenge, I think specialty carriers and units within standard carriers will continue to develop for high-exposure businesses. The sleeper in all of the exposures may be employee dishonesty. Businesses tend to be underinsured for this exposure, even before considering cyber theft. The content of most of the policies I saw however weren't that impressive, I thought.
Some policies try to describe every possible cause which can lead to damage.
Buying a separate policy doesn't make sense to me. For first-party damage under our property insurance, our preference goes out to broaden the definition of property with information assets, for example. But the Insurance Industry has traditionally covered 'new' exposures this way. Over time, the coverages will be blended into 'regular' policies. I hear that a lot of companies are 'evaluating' them.