[Bender]

If a company's already been hacked, what makes them think they have the knowledge/expertise to fight back?

Not required. This is unlikely to be random SecOps and SecEng corporate employees as the legal risk is too high as government administrations are replaced every few years.

Just like real piracy at sea companies would hire mercenaries or nowadays referred to as private military contractors. The fight back would just be to initially identify them (attribution) then activate PMC's at or near their location and neutralize the root cause.

With time countries will tire of random PMC's showing up and will take a stronger approach to dealing with their own hackers in addition to making the internet less anonymous. The effort to make the internet less anonymous has clearly already started as HN have been witnessing. Efforts like bcp38, 84 [1] authenticated packets likely using a nonce after government ID based auth and many other methods will be implemented as previous efforts have stalled.

[1] - https://www.rfc-editor.org/bcp/bcp84.txt