Good money can buy a good chunk of 0-day exploits from black hats. I wonder how many companies rely on in-house exploit research and what would be the turnarou

Good money can buy a good chunk of 0-day exploits from black hats. I wonder how many companies rely on in-house exploit research and what would be the turnaround related to buying from 3rd parties.