Yes, but the defenders need to make money to fund their work and be right every time to be effective, and have a high degree of accountability if they fail to secure stuff while attackers can be less considerate of how they spend their resources and have less accountability for the havoc they wreak while attempting to extract value.