"All advantage goes to the offense in cyber. It just does. On the defensive side, you have to say 'I must defend all 100,000 machines, all 50,000 employees.' The offensive side thinks, 'I only need to break into one and I'm on the inside.'"
--Kevin Mandia
This is one of the key reason for Red Teaming. Act, don't react.