Ghidra itself is still what they use, they released it so that potential hires don't have to be retrained from IDA Pro. What they don't release, however, is Ghi

Ghidra itself is still what they use, they released it so that potential hires don't have to be retrained from IDA Pro. What they don't release, however, is Ghidra plug-ins. I'm sure they have a vast trove of plug-ins for specific reverse engineering they do, and probably some that check for known holes they can exploit.