There should be two market indices. One should include those few companies that are serious about zero-day vulnerabilities and IT security in general. For exam

There should be two market indices. One should include those few companies that are serious about zero-day vulnerabilities and IT security in general. For example, they should be active with bug bounties. The other one should include stock of rest of market, with proportion of sectors close to first. I wonder, which would do better?