Most companies are far too optimistic regarding security