Executive overconfidence is a security risk