I'd probably have them work on finding as many zero-day vulnerabilities as possible - after the 100 days I'd probably keep the top 5-10 performers on salary if

I'd probably have them work on finding as many zero-day vulnerabilities as possible - after the 100 days I'd probably keep the top 5-10 performers on salary if I was able to make enough money from the research.