I follow the field, and I'd say defensive companies (anti malware, intrusion detection, monitoring, anti fraud etc.) outnumber offensive companies 100-to-1.