I share your concern. This is similar to many problems in the InfoSec community which can not simply be solved by a corporation by throwing money at them but instead require long-term cultivation of contacts, trust and expertise by a few / single individuals, something that money can't buy.