Richard Bejtlich wrote this back in 2009. It is still very much the same today, only worse.
Earlier this month I wondered How much to spend on digital security. I’d like to put that question in a different light by imagining what a black hat could do with a $1 million budget.
[…]
… I submit that for $1 million per year an adversary could fund a Western-salaried black hat team that could penetrate and persist in roughly any target it chose to attack. This team has the structure and expertise to develop its own attack methods, execute them, and sell the results of its efforts to the highest bidders.