Defense is always playing reactive. Attack gets to be creative and figure out how to break whatever tools defense has. Defense has to wait until the vulnerability is found and then deal with it. It’s the nature of the arms race with regards to cyber security.