Companies may not be fully grasping—or explaining—how they handle cyber risk in their 10-K annual reports, leading some to unintentionally cast their attack defenses as stronger than they are.

Such are the findings from cybersecurity consulting firm Halock Security Labs’ review of thousands of 10-Ks in the year since the Securities and Exchange Commission enacted its cyber risk disclosure rules.