If you are attacking a system, you can try 100 things. If one thing works in getting access, you succeed.

If you are defending a system, you must defend against all 100 things. If one thing makes it through, you lose.