Scoring the Unscorables: Cyber Risk Assessment Beyond Internet Scans