Protecting critical infrastructure from cyberattacks means confronting a mismatch between the threat and the government’s ability to respond.