Effect measures for group comparisons in a two-component mixture model: a cyber risk analysis