Selling 0-Days to Governments and Offensive Security Companies
summary
Overview of the zero‑day market: a vulnerability brokerage model (example: Q-recon) connects researchers to governments and offensive security firms, with roughly 400 people worldwide active in open sales and public platforms showing ~166,000 registered hackers submitting ~72,000 bugs (≈73% web issues). Deals use a 14-day validation window, source is delivered under contract, and payments are typically split with remainder paid over three months; pricing hinges on exclusivity, exploit quality, support obligations and export controls like Wassenaar.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:04Speaker background
- 2:59Zero-day market evolution
- 4:26White hat research
- 7:20High-end market products
- 10:14Market buyers analysis
- 12:27Researcher lifecycle
- 16:13The selling process
- 17:55Pricing vulnerabilities
- 20:47Validation and specs
- 23:54Payment structures
- 26:01Property and support
- 27:48Legal and regulations
- 30:45Finding customers
- 32:43Role of brokers
- 35:14Best practices for sellers
- 39:17Tips and tricks
- 40:47Q&A session
related talks
36mFrom Bounties to Bureaucracy
39m"Vulnerabilities for Sale - The Good, the Bad and the Ugly"
24mHacking The 0day Market
56mZero Days, Thousands of Nights: The Life & Times of Zero-Day Vulns and Their Exploits
40mTales from the Underground: The Vulnerability Weaponization Lifecycle
15mThink Zero Days Are Your Your Biggest Risk - Think Again
44mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
57mExtortion and Cooperation in the Zero-day Market