CISA actually monitored Internet traffic and would contact government entities (local, schools, universities, etc) when they were being attacked. I went to a talk once where they said they usually had response times in minutes, and it would take longer to figure out who they needed to alert and convince them that it was real. Now that CISA is gutted I would expect more and worse breaches in the future.