Honestly, most boutique, government-involved security consulting firms have similar requirements. Given how much of tech is outsourced these days, obscurity is often the only line of defense some organisations have.