Security firms ‘overstate hackers’ abilities to boost sales’