How big is the space of potential exploits? If organization A searches for exploits for five years in a given piece of software, and organization B does the sa

How big is the space of potential exploits? If organization A searches for exploits for five years in a given piece of software, and organization B does the same, what percentage of the exploits they find will be found by both rather than just one? If hackers/governments tend to find the same exploits as each other then it makes more sense to take a defensive strategy since you can protect against a large portion of the weapons your enemies develop. But if there's not much overlap in which exploits are found then an offensive strategy may make more sense. In the nuclear arms race there was basically one type of attack and one set of mitigations. In cyberwarfare there are potentially endless types of attacks, each with its own set of mitigations. This changes the calculus. The likelihood of one's weapons being stolen and used against you, your allies, or humanity in general is also a huge consideration.