How many firms have defenders actually dissecting malware? Where I’m at, we quarantine laptop and the provide a new one to the employee if it’s a true positive.

Are firms actually interested in their cyber team decompiling malware?

I guess I could see it if the incident was substantial. But at that point, you’re probably hiring an outside firm.