They do that already. They're not going to come to your company and configure things for you, but they'll report vulnerabilities (https://www.cnet.com/news/major-windows-10-security-flaw-rep...), give guidance on policies (https://us-cert.cisa.gov/ncas/current-activity/2021/02/26/ns...), create security frameworks (https://web.archive.org/web/20201022103915/https://www.nsa.g...) and many other things.