disclaimer: I haven’t sold a single exploit, so am taking a few guesses here. Approx ~5 of my relatively close friends are exploit devs, and most of them don’t

disclaimer: I haven’t sold a single exploit, so am taking a few guesses here. Approx ~5 of my relatively close friends are exploit devs, and most of them don’t talk about anything beyond the name of the company they work for. There aren’t a ton of companies, but once you’ve worked in the general offense industry, names start to reappear regularly. I’m not sure what your definition of good/bad guy is. If you don’t like the idea of 0day used for “cyber warfare” then it’s easy: only sell directly to the vendor. If your idea of good guy is your own nation, you can usually tell a companies alignment. They’ll have an ex-NSA CEO, or close partnership with a defense contractor. Ultimately you’re never sure though. Edit: I’ll also add that in your earlier post you mention the high cost, and wasting of taxpayer dollars. I don’t disagree, but an interesting way to look at it is value per dollar. If you look up the cost of running a state of the art attack helicopter or even just a couple of hummers loaded up with navy seals and all their kit, you find that dropping a $1m piece of remote Jailbreak malware on a bad actor is actually really amazing ROI in terms of finding out what your enemy is upto, and disrupting their plans.