Cyber isn’t just about defense anymore, governments increasingly assume they’ll use offensive cyber tools as part of state power