> Finally, I think you're much more familiar with Mayhem than I am, but I call into question the bugs Mayhem found. How many were high severity and/or actually

> Finally, I think you're much more familiar with Mayhem than I am, but I call into question the bugs Mayhem found. How many were high severity and/or actually exploitable? (I'm actually asking because I've seen conflicting reports from both Mayhem and Michal Zalewski on the matter). Exploitable? Every. Single. One. Each came with a unique PoC demonstrating control of execution. > However, I think that it's hard to know who to partner with. For all the organizations that you can partner with to produce fruitful research, you have many who are trying to make a quick buck on the trendiness of security. We don't have a lot of Mayhems. We have a lot of Acunetixes. This sounds like you simply haven't investigated where or how to get money for R&D!