Disentangling the sources of cyber risk premia