The Exploit Market: Bounties, Brokers & Zero-Day Trade

Q: Why exploits have value at all?

The core asset is the zero-day: a vulnerability the vendor does not yet know about, for which no patch exists. Because there is no fix, an exploit for it works against every up-to-date system running the affected software. That reliability against fully patched targets is what makes it valuable. See Zero-Day Vulnerabil

A vulnerability by itself is a possibility. An exploit is the working code that turns that possibility into a usable attack, and working code is a commodity that people will pay for. The question that shapes the entire subject is who they pay, and why the same flaw can be worth a few thousand dollars in one channel and a fortune in another. The answer is a market with legitimate, gray, and criminal sides, each operating by different rules.

This guide explains how the exploit market works at a conceptual level: the channels a discovered vulnerability can flow into, what actually drives the price of a zero-day, the role of brokers, and the unresolved ethics and policy debate underneath it all. It deals in dynamics, not prices, because the numbers move and the specifics change. The structure is what lasts.

Why exploits have value at all

The core asset is the zero-day: a vulnerability the vendor does not yet know about, for which no patch exists. Because there is no fix, an exploit for it works against every up-to-date system running the affected software. That reliability against fully patched targets is what makes it valuable. See Zero-Day Vulnerabilities for the underlying concept.

The moment a vulnerability is disclosed and patched, the exploit's value falls sharply, because defenders can now close the hole. So the value of an exploit is tied directly to its secrecy. This creates the central tension of the whole market: the act that makes a flaw safe for everyone, disclosure, is the act that destroys its market value for the person who found it.

On MITRE ATT&CK, developing exploit capability maps to Exploits (T1587.004) and buying it maps to Obtain Capabilities: Exploits (T1588.005). Both the build and the buy are recognised adversary behaviours, which tells you how normalised the trade has become.

The three channels

The same researcher who finds the same bug faces a choice of markets, and the choice determines both the payment and the consequence.

Channel	Buyer	What they want	Outcome for users
Bug bounty / disclosure	The software vendor	To learn about the flaw and fix it	Flaw gets patched, everyone safer
Broker / gray market	Governments, agencies, contractors	To keep the flaw secret and usable	Flaw stays open, used offensively
Black market	Criminals	An exploit to make money now	Flaw used against victims

Bug bounties and coordinated disclosure are the legitimate channel. A vendor pays a researcher to report a vulnerability so it can be fixed, following a coordinated disclosure process. The payment is a reward for making software safer, and the flaw ends up patched. This channel optimises for defence.

Brokers and the gray market buy exploits to keep them working. Their customers are typically governments and their contractors, who want offensive capability for intelligence, law enforcement, or military use. Brokers pay far more than bounties precisely because they need the flaw to stay secret rather than fixed. The market is legal in many jurisdictions, lightly regulated, and opaque, which is why it is called gray.

The black market is the criminal channel, where exploits are sold to whoever will pay to attack victims for profit. It overlaps with the broader underground economy of stolen data and access.

Exploits feed the same pipeline as everything else

Once an exploit reaches a criminal channel, it becomes another input to the attack economy, alongside stolen credentials and network access. Our Exploit Intelligence dashboard tracks which vulnerabilities are actually being weaponised and how fast they move from disclosure to real-world exploitation, which is the defender's view of where this market is aimed.

What drives the price of a zero-day

Exploit pricing is not arbitrary. A handful of factors explain most of the variation, and understanding them explains why some bugs are worth vastly more than others.

Target difficulty. Exploiting a hardened, heavily defended platform is harder than exploiting a neglected one. Modern mobile operating systems and mainstream browsers have years of exploit mitigations built in, so a working exploit against them represents an enormous amount of research and commands the highest prices. A flaw in obscure or poorly defended software is worth far less.

Deployment breadth. An exploit against software running on billions of devices is worth more than one against a niche product, because it can reach more targets. Popularity of the target is a direct price multiplier.

Reliability and interaction. The most valuable exploits are the ones that work every time and need no help from the victim. A "zero-click" exploit that compromises a device with no user action is worth a large premium over one that needs the target to open a file or tap a link. Reliability under real conditions matters as much as the initial breakthrough.

Chaining. Serious attacks against hardened platforms rarely use one bug. They chain several, one to get in, others to escape a sandbox and gain privileges. A complete, working chain is worth far more than the sum of its parts, because assembling it is the hard part.

Expected longevity. This is the factor outsiders miss. An exploit's value depends on how long it is expected to keep working before the underlying flaw is independently found and patched. A bug in code that is under heavy scrutiny may be short-lived and therefore cheaper, while one in a quiet corner of a codebase may survive for years and is priced accordingly.

A patch can wipe out an inventory overnight

Because value depends on secrecy, a single vendor patch can render a stockpiled exploit worthless the moment it ships. Everyone holding that capability, offensive agencies included, loses it at once. This is the risk that sits behind every decision to retain a flaw rather than report it.

The ethics and policy debate

The exploit market forces a genuinely hard question with no clean answer, and it is worth stating both sides plainly.

The case for retention is that offensive capability is a legitimate tool of national security and law enforcement. Intelligence agencies argue that keeping certain vulnerabilities secret lets them gather intelligence, disrupt threats, and act against adversaries who use the same technology. From this view, a stockpiled zero-day is a strategic asset.

The case for disclosure is that a vulnerability kept secret is not secret to everyone. The same flaw can be discovered independently by an adversary, and while a government holds it, its own citizens and companies remain exposed. Patching the flaw protects everyone at once. From this view, hoarding vulnerabilities trades broad public safety for a narrow offensive advantage, and the trade is a bad one.

This tension is why governments that retain exploits generally run some form of review process to decide, case by case, whether to disclose a flaw for patching or keep it. The existence of such processes is an admission that the question is real and that the default is contested. The CISA coordinated vulnerability disclosure process represents the disclosure-favouring side of the same debate at the operational level.

There is also the broker regulation question. When companies sell powerful exploits and surveillance capabilities to governments, those capabilities can end up used against journalists, dissidents, and political opponents. That has pushed the debate toward export controls and human-rights conditions on the trade, an area that remains unsettled.

What this means for defenders

You are not a buyer or seller in this market, but its dynamics shape your risk directly.

Assume valuable targets attract exploits. If you run widely deployed, high-value systems, you are the kind of target expensive exploits are built for. Defence in depth matters because a single flaw may already be exploitable.
Patch speed is your lever against the gray market. The whole model depends on flaws staying open. Fast, reliable patching shortens the window in which any exploit works and directly erodes its value.
Support the legitimate channel. Bug bounties and coordinated disclosure move flaws toward being fixed. Backing that channel is one of the few ways defenders influence the supply side. See The Bug Bounty Economy Explained.
Watch what is actually being used. Most day-to-day attacks use known, patchable flaws, not exotic zero-days. Track real-world exploitation and fix what is under active use first.

The exploit market is not going away, because both defence and offence are willing to pay for the same thing. The realistic goal is to make your own systems patch fast enough that whatever a flaw was worth, it is not worth it against you for long.

How the market took shape

The trade in exploits is older than the formal market that surrounds it now. In the early years of the commercial internet, vulnerability information moved informally: researchers posted findings to public mailing lists, vendors reacted at their own pace, and there was little money in the loop. That arrangement created a standoff. Researchers who reported flaws often received no reward and sometimes legal threats, while vendors complained that public disclosure armed attackers before a patch existed. Out of that friction came the two institutions that define the market today.

On the defensive side, coordinated disclosure and, later, formal bug bounty programmes gave researchers a legitimate, paid path to report flaws. A vendor commits to fixing reported bugs within a window and to paying for qualifying reports, and in exchange researchers agree to hold public details until a patch ships. This turned a hostile relationship into a transaction and pulled a large volume of vulnerability research into the open.

On the offensive side, a parallel market grew for keeping flaws secret rather than fixing them. Buyers who wanted working capability, intelligence agencies, law enforcement, and the contractors who serve them, were willing to pay far more than any bounty, precisely because their value depended on the flaw staying unpatched. Brokers emerged to sit between researchers and these buyers, aggregating supply, vetting quality, and taking a cut. The same discovery that a vendor might reward with a moderate bounty could command a large multiple through a broker, and that price gap is the engine that keeps the gray market supplied.

The result is a layered ecosystem where the same raw finding can flow into radically different outcomes depending only on who the finder decides to sell to. Understanding that the structure grew out of a disclosure standoff explains why the ethical debate underneath it has never resolved: the market was built on the unfinished argument about whether flaws should be fixed or kept.

A vulnerability's journey, three ways

To make the channels concrete, follow one hypothetical finding through each path. A researcher discovers a memory-corruption flaw in a widely used mobile messaging app that can be triggered by a specially crafted message with no user interaction. That is a valuable property, because no-interaction bugs against popular platforms sit at the top of the price ladder. What happens next depends entirely on the channel.

Down the bug bounty path, the researcher writes a report, submits it through the vendor's programme, and works with the security team to confirm the issue. The vendor develops a patch, ships it to every user, credits the researcher, and pays the bounty. The flaw is now closed for everyone. The researcher's reward is bounded by what the programme offers, and the capability is destroyed the moment the patch lands.

Down the broker path, the researcher instead approaches a broker who buys offensive capability. The broker validates that the exploit is reliable, negotiates a price far above any bounty, and resells it to a government customer. The vendor never learns of the flaw, so no patch ships, and the capability keeps working against every up-to-date device until someone else independently finds and reports the same bug. The researcher earns more, and every user of that app remains exposed for as long as the secret holds.

Down the black-market path, the researcher sells to a criminal buyer who wants to use the exploit for profit. Here the capability is turned directly against victims, folded into the same underground economy that trades stolen data and network access. The payout may be lower than a top-tier broker deal, with more risk to the seller, and the harm is immediate.

The point of the comparison is that the technical artefact is identical in all three cases. The same exploit, the same reliability, the same target. Everything that differs, the payout, the legality, and the consequence for millions of users, is a function of the destination the finder chose. That is the moral weight the market places on a single decision.

Detection signals for defenders

You cannot watch the exploit market directly, but its output leaves traces, and a defender can build signals around the moments when a private capability becomes a public problem.

A patch with a terse advisory and signs of active use. When a vendor ships an out-of-cycle fix and describes a flaw as exploited in attacks, that language often marks a capability crossing from secret to known. Treat such advisories as the highest priority in your patch queue.
Exploitation before broad disclosure. Telemetry showing a flaw being used against a small set of targets before any public detail exists is the fingerprint of a bug that lived in the gray market. Threat-intelligence feeds that flag in-the-wild exploitation are the practical way most teams see this.
A sudden cluster of scanning for a freshly disclosed flaw. Once a bug is public and patched, commodity actors race to exploit unpatched systems. A spike in probes for a specific endpoint or version string is the market's downstream echo, the phase where a formerly expensive capability becomes cheap and widely used.
Anomalies consistent with no-interaction compromise. Devices showing signs of compromise without any user action, no clicked link, no opened file, are the profile of a zero-click exploit, which is the class the offensive market prizes most and prices highest.
Vendor credit patterns in advisories. Over time, tracking which flaws were reported through disclosure versus discovered in attacks tells you where a given product's risk is concentrated and how much of its research is flowing to defensive channels.

The defensive throughline is that your visibility begins at disclosure. Everything before that, the discovery, the sale, the private use, is outside your view, which is why speed after disclosure is the lever you actually control.

Common misconceptions

"Zero-days are the main way I will get attacked." For most organisations the opposite is true. The overwhelming majority of real-world compromises use known, already-patched flaws against systems that were slow to update. Zero-days are expensive and reserved for high-value targets, so unpatched known bugs deserve your attention first.

"The gray market is illegal." In many jurisdictions it operates legally and openly, with brokers running as registered companies. Legality is exactly why it is called gray rather than black. The debate around it is about export controls and human-rights conditions, which are still being written.

"A high price means a bug is more dangerous to me personally." Price reflects offensive utility against hardened, widely deployed targets, not the everyday risk to a specific organisation. A cheap, well-known flaw on an internet-facing server you forgot to patch is far more likely to hurt you than a million-dollar mobile chain.

"Disclosure always makes everyone safer immediately." Disclosure starts a race. Patching closes the flaw for those who update quickly, and it also arms every attacker who now knows the bug exists. The safety benefit is real but it depends on defenders patching faster than opportunists can weaponise the public details.

"Bug bounties let companies buy silence cheaply." A functioning programme is a supply-side intervention that moves flaws toward being fixed. It competes, imperfectly, with the offensive market for the same researchers, and the flaws it captures end up patched for everyone rather than held in secret.

The defender's real market position

You do not buy or sell in this market, yet its economics set your exposure. Every unpatched flaw on your estate is, in effect, inventory that someone else may already hold. Fast, reliable patching does two things at once: it shrinks the window in which any given exploit works against you, and it lowers the value of that exploit to whoever is holding it. You cannot change what a capability is worth in the abstract, but you can make it worthless against your own systems sooner than the attacker expected.

Frequently asked questions

What exactly is the difference between a vulnerability and an exploit? A vulnerability is a flaw in software that could allow unintended behaviour. An exploit is the working code that reliably turns that flaw into a real attack. The vulnerability is the possibility; the exploit is the proven method. The market pays for exploits because reliable, weaponised code is far harder to produce than a bug report.

Why would a government pay more for a flaw than the vendor that made the software? Because they want opposite things. The vendor pays to learn about the flaw and close it, which ends its usefulness. A government buyer pays to keep it open and usable as an intelligence or law-enforcement capability. Secrecy has a higher value to the buyer who needs the flaw to keep working than a fix has to the vendor, so the offensive price runs well above the bounty.

What makes an exploit expensive? Chiefly: how hard the target is to exploit, how many devices run it, whether the exploit needs any user interaction, whether it works reliably every time, and how long it is expected to survive before being independently found and patched. A reliable, no-interaction exploit against a hardened, ubiquitous platform sits at the top; a fragile bug in niche software sits near the bottom.

What is exploit longevity and why does it matter to price? Longevity is how long a flaw is expected to keep working before it is discovered and fixed by someone else. A bug in heavily audited code may be short-lived and therefore cheaper, because the buyer gets less use out of it. A bug in a quiet, rarely reviewed corner of a codebase can survive for years and commands a premium for that expected lifespan.

Is buying or selling exploits ethical? It depends who you ask and which channel. Selling to a bug bounty is broadly accepted, because the flaw gets fixed. Selling to a broker who supplies governments is legal in many places but ethically contested, especially when capabilities reach regimes that use them against journalists and dissidents. Selling to criminals is straightforwardly harmful. The same act carries very different weight depending on the buyer.

How does this market affect an ordinary company that is not a spy target? Indirectly but really. Capabilities built for high-value targets eventually leak, get independently rediscovered, or are folded into criminal tooling once patched, at which point they become cheap and widely used. Your defence is the same regardless of the original buyer: patch fast, layer controls, and assume any internet-facing flaw is being scanned for.

What can defenders learn from watching which flaws are actually used? That effort should follow real exploitation, not theoretical severity. A moderate-severity flaw under active attack deserves attention before a critical-rated one that no one is using. Tracking real-world exploitation, as opposed to raw vulnerability counts, is how mature teams decide what to fix first.