“Attackers are getting better than most defenders,” according to an advisor to the U.S. Cybersecurity and Infrastructure Security Agency.