Government agencies often focus on the threats that affect their cyber systems — and for good reason. But what evidence do they have to prove the value of their security investments?