So we'll cede the cost to end users - many thousands in potential losses to hospitals, banks, etc. if they get hacked. The problem is that the hospital isn't the buyer of the exploit, they're the buyer of the tool/ware/etc. that patches or prevents the use of the exploit. It's the antivirus guy whose pockets we're reaching into so the value of exclusive knowledge of the exploit has to be measured against how that exclusive knowledge equates to more sales of the product or the product's pricing -- and the product isn't typically priced (or at least not priced "fairly") with respect to potential losses from failing to close the vulnerability.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/470/35034#35034