Cyber insurance premium credits reward specific security controls, but the savings vary widely. Here's what actually moves the number and what doesn't.