> Having offensive capabilities and actually utilizing such capabilities are two different things. You can acknowledge the need for the former alongside the dangers of the latter, just as you would with any standing military.
In information warfare, waiting until conflict begins is too late. The information you collect and systems you exploit prepare you for the conflict.
For example, country A wants to know about country B's new bomber years ahead of the conflict so they can design anti-aircraft defenses to stop it. Country B spends years gaining access to Country A's routers, servers, etc. so they can utilize them the moment conflict begins.
If you wait for conflict to begin to do these things, you will be much too late.