The Wolves of Vuln Street - The First System Dynamics Model of the 0day Market

HackerOne, in collaboration with MIT and Harvard researchers, models the 0day market and concludes that while bug bounties accelerate vulnerability discovery—particularly for immature software—the more scalable defensive strategy is to incentivize tools and techniques (automation, fuzzers, exploitability analysis) that increase collision with offensive findings; the report recommends broadening policy focus, expanding programs like the Internet Bug Bounty to reward such tooling, and prioritizing investments in Secure Development Lifecycles and defensive tooling rather than attempting to outbid offensive buyers.