While more money has been thrown at the problem, the US still lacks the people. Quantity has a benefit over quality here if you have 1 blue force for every 15 red forces. Cyber attackers only need to get an exploit running once for success. Defenders need to stop exploits every single time.

Add on to that very strict requirements for US persons to be able to legally conduct offensive cyber actions (clearances) and relatively low pay compared to security research or information security careers, you quickly get to a point where you take what you can get, especially when you're down to 76% of your ideal manpower

https://breakingdefense.com/2023/08/how-dod-is-thinking-outside-the-box-to-solve-its-cyber-workforce-challenges/