>An overwhelming majority of vulnerabilities if not actively pursued and discovered would never be known so as to be exploited other than in extreme cases. The

>An overwhelming majority of vulnerabilities if not actively pursued and discovered would never be known so as to be exploited other than in extreme cases. There are two ways I can read it, the first being almost a tautology (if no one pursues it, then it won't likely be found by accident), and the second (if white-hats don't pursue it, then it won't be found by black-hats either) sounds very unreasonable to me. The black market for zero-days is quite active, with prices for a single vulnerability in the millions [0,1]. So I'd appreciate if you can provide any citation that the "overwhelming majority" of security researchers are white hats. I'd find that to be as surprising as a statement that an overwhelming majority of people breaking into houses are locksmiths. [0] https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits [1] https://arstechnica.com/information-technology/2019/01/zeroday-exploit-prices-continue-to-soar-especially-for-ios-and-messaging-apps/ https://arstechnica.com/information-technology/2019/01/zerod...