Or they're chasing threat actors, ransom groups, etc as part of a larger investigation.