As soon as a security patch is released, it will be reverse engineered and exploited, regardless of whether PoC code has been released. >Rapid7's "we release f

As soon as a security patch is released, it will be reverse engineered and exploited, regardless of whether PoC code has been released. >Rapid7's "we release full details and ready-made exploits the very day vendor releases a patch" This is not their whole policy. They have exceptions, extensions, etc. But yes, they will publicly disclose a vuln if your company decides to refuse coordinated disclosure and choose to silent patch. They also don't release "ready-made exploits", please don't be hyperbolic. They release technical details about exploits, yes. But they aren't releasing metasploit modules or the likes... See also from Project Zero (assuming that is your preferred vendor?): >Any attacker with the resources and technical skills to turn a bug report into a reliable exploit chain would usually be able to build a similar exploit chain even if we had never disclosed the bug