NSA has long had an explicit offensive and defensive mandate. They even recently created a cyber defense directorate:

https://www.washingtonpost.com/national-security/nsa-launche...