The Case for a Compulsory Bug Bounty
Summary: A new paper by NSS Labs research director Stefan Frei proposes an international vulnerability purchase program in which major software vendors would buy all known vulnerabilities at prices above black-market rates, such as $150,000 per flaw. Frei found the top 10 software makers accounted for more than 30 percent of all flaws fixed in 2012, and that paying top dollar for every one would cost Oracle, which fixed more than 427 vulnerabilities on $37 billion in revenue, less than two-tenths of one percent of annual revenue.
Key Takeaway: Frei's estimate that private vulnerability buyers give access to at least 85 zero-day exploits on any given day is the baseline defenders are working against, and his program would cost top vendors under one percent of annual revenue while Errata Security's Robert Graham argues most breaches stem from weak credentials, social engineering, and poorly configured web applications rather than commercial software flaws.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026