Really, NSA is captive to the law that bureaucracies do exactly what you tell them to do. NSA is budgeted to conduct cyber offense and governmental defense, so

Really, NSA is captive to the law that bureaucracies do exactly what you tell them to do. NSA is budgeted to conduct cyber offense and governmental defense, so private-sector defense is outside the mission; in fact, it conflicts with the former even as it connects with the latter. So NSA is only going to help you if the risks to its defensive mission outweigh the value to its offensive mission (not that organizations have rigorous tests for these things, but whoever yells the loudest is usually a good proxy for it). The best approach, IMO, is to take cyberdefense out of NSA entirely and give someone like CISA an active mission to maximize whole-of-nation digital defense. While this doesn’t entirely mitigate moral hazard between the offensive/defensive mission balance, at least you’ve got competing budgets that have an incentive to work against each other.