As the U.S. pours money into cyber offense, private companies are mostly left to defend themselves.