U.S. business SEC filings suggest cyber threats may be overstated