If we don't get ahead of this we'll regulatory capture ourselves into oblivion and the enemy will win anyway. As long as state-sponsored-actors are indistinguishable from black-market criminals this will never escalate beyond the perpetual cat and mouse game. We simply have to be better, and we can't have oversight committees and regulatory boards managing it. Infosec is ripe for being revolutionized.