>> The inspiration for MozDef comes from the large arsenal of tools available to attackers. Suites like metasploit, armitage, lair, dradis. Defenders are usually limited to wikis, ticketing systems and manual tracking databases attached to the end of a Security Information Event Management (SIEM) system.

I read this as: attackers are usually one step ahead at least, and "defenders" (sic: developers (?) ) do not like pentesting? These tools are available to anyone..