I work in app security, and maybe 1% of the testers I know (I know a lot of testers) are familiar with crypto attack methodologies. It's still a dark art. I don't know where a company that wasn't "plugged in" would ever find expertise.