Selling 0-Days to Governments and Offensive Security Companies
summary
Overview of the market, value drivers and concrete deal mechanics: vulnerability brokers and buyers pay highest for 0-click/fat unicorn vectors, typical deals use non-exclusive licenses with split payments, brokers commonly take 50–70% and payouts benchmarked from recent public leaks; the truly marketable pool is ~400 researchers worldwide, validation windows run about 14-day validation, contracts hinge on a precise spec, support fees are billable, and Wassenaar-style export controls force companies or licenses for cross‑border sales.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:40About me
- 2:34Overview
- 6:33HighEnd Market
- 11:20How do you get them
- 12:09My experience
- 14:33The process
- 18:38The contract
- 23:42Property rights
- 28:35Finding customers
- 31:17Working with brokers
related talks
39m"Vulnerabilities for Sale - The Good, the Bad and the Ugly"
36mFrom Bounties to Bureaucracy
40mTales from the Underground: The Vulnerability Weaponization Lifecycle
24mHacking The 0day Market
56mZero Days, Thousands of Nights: The Life & Times of Zero-Day Vulns and Their Exploits
51mThe World Of Spyware For Rent
11mOutsourcing Cyberwar
15mThink Zero Days Are Your Your Biggest Risk - Think Again