Cyber risk ordering with rank-based statistical models