Analyze the underground and legitimate markets for zero-day vulnerabilities, quantify the price discovery mechanisms that determine exploit values, and assess why responsible disclosure programs have failed to reduce the supply of undisclosed exploits to state and criminal actors.

Analysis of leaked zero-day pricing data from underground forums (2015-2024), academic pricing studies of vulnerability markets, CISA zero-day exploit tracking database, and financial incentive analysis of bug bounty programs vs. black market alternatives. Cross-referenced with analysis of government cyber procurement budgets for vulnerability acquisition.

The underground zero-day market is estimated at $300M-$2B annually, with individual exploits trading at $50K-$500K depending on target system and exclusivity. Contrary to cybersecurity industry claims, responsible disclosure and bug bounty programs have not reduced the supply of zero-days to state-sponsored buyers.

, Android zero-days) command premium prices and are withheld from disclosure; low-value exploits flow into bug bounty programs where they generate goodwill but modest financial reward. Government agencies (NSA, GCHQ, etc.) are among the largest buyers, with budgets for zero-day acquisition integrated into intelligence agency appropriations.

This creates a perverse incentive structure where security researchers can earn 5-10x more selling to state actors than to bug bounty programs.