Criminals winning ‘cyber arms race’