The early days of SEC cyber-incident disclosures haven't revealed much—and that may be a problem.