[bediger4000]

Not if there's no federal or insurance company mandate.

Also, you're assuming that there's a market for rootkits/implants, and "tailored access operations", rather than incident responders and checklist reviewers, which is what the giant bulk of corporate cyber security involves.

[throwaway5752]

Oh, there is certainly a market. That is why you keep them employed as whitehats, or at least in service of state security.