Attackers in cyberspace have long held system-wide advantages. Fighting back requires measuring progress.