In my mind, most countries can't figure out how to plan or coordinate a cyber-attack. With a limited pool of nations to pick from, even being able to coordinate an attack makes you relatively "very competent" (among your peers), however, that would also be a matter of perspective. It's equally valid to determine a criteria of competency and rank/describe countries based on those thresholds.