Well, maybe the lemma is flawed. Maybe they are not always ahead. I mean, to date, no one has even been able to decode Kryptos, right out front of the CIA in plain view: https://en.wikipedia.org/wiki/Kryptos
Again, what the NSA does to protect the US is an open question; if they did their job right, you'll likely not know it. Updating systems, at least large commercial ones that foreign governments use as well as the US citizenry, is not in the purview of their mandate, its the opposite. They do try to tell the world what they do, so as to justify themselves in some degree to their ultimate bosses (the US voting public). The Iranian nuke viruses are a good example, though, as far as I know, they have not claimed that particular hack yet.
Again, what the NSA does to protect the US is an open question; if they did their job right, you'll likely not know it. Updating systems, at least large commercial ones that foreign governments use as well as the US citizenry, is not in the purview of their mandate, its the opposite. They do try to tell the world what they do, so as to justify themselves in some degree to their ultimate bosses (the US voting public). The Iranian nuke viruses are a good example, though, as far as I know, they have not claimed that particular hack yet.