They know where their servers are. They may know where their applications are. They may even have an SBOM program. But ask a simple question: Where are we using RSA, Diffie-Hellman, ECDH, ECDSA, DSA, ...