how sophisticated is the penetration testing of government infrastructure? It seems to me like one should invest roughly as much in defensive (so penetration te

how sophisticated is the penetration testing of government infrastructure? It seems to me like one should invest roughly as much in defensive (so penetration testing etc.) as in offensive capabilities. Maybe even more, because the attack surface is so big.