In order to conduct an appropriate vulnerability assessment, you need to be able to classify your adversaries capabilities and motivations. That's hard to do wi

In order to conduct an appropriate vulnerability assessment, you need to be able to classify your adversaries capabilities and motivations. That's hard to do with out some kind of privileged information. Only then can you get down to the stuff that most people think of when they talk about "security" - e.g. the risk mitigation and countermeasures. Edit - added text To continue the point, the Russia example is important. Individual commercial ventures are not set up to handle state level attacks. Any company that thinks they are is going to be in for a rude awakening. Worse, companies like Google and Facebook are going to be vulnerable by their very design and function. Sure, the credit bureau hacks are bad, but truthfully that's only the tip of the iceberg as far as consequences. I'm not discounting your point that you may have found government cooperation unhelpful, but I will say if you are one of these large companies that could be the target of a state level actor, you are going to want a state level actor on your side. And in the US that means you are going to have to have employees with access, which means you are going to need to have a government sponsor for clearances.