Companies may not be fully grasping—or explaining—how they handle cyber risk in their 10-K annual reports, leading some to unintentionally cast their attack defenses as stronger than they are.