Here's the kicker, technically NSA can't even do offense (attack). That's what US Cybercom is for. The NSA primary missions are SIGNIT and IA as a combat support agency. So they can gather information on foreign adversaries (and defend DoD networks), but they don't have the mandate to actually perform cyberwarfare. Or for that matter defend civilian networks against attack.

NSA and USCC is a distinction without a difference. They've even got the same head honcho.

Both organizations focus on similar concepts (after all exploitation and attack are two sides of the same coin). But there is a legal distinction which is important. NSA legally cannot do all that CYBERCOM can do.

You're absolutely correct, it's legally a massive difference. In practice, they're more or less the same people groups of the same people.

So I tend to view the distinction between the two as something of a legal fiction.