A new survey suggests many businesses are overconfident in their ability to protect against cyberattacks.