Both organizations focus on similar concepts (after all exploitation and attack are two sides of the same coin). But there is a legal distinction which is important. NSA legally cannot do all that CYBERCOM can do.