Why Does Cybercrime Have a Better Business Model Than Responsible Disclosure?

The cybersecurity industry cannot continue to depend on the goodwill of benevolent researchers while criminal enterprises build increasingly efficient markets for offensive capabilities.

1. The Uncomfortable Question

Consider two individuals who independently discover a security weakness affecting a major corporation.

The first is an ethical security researcher. They investigate the weakness, establish its potential impact, gather supporting evidence, identify the appropriate disclosure channel, and prepare a detailed technical report. They may spend days documenting their findings before submitting them to a Security Operations Center (SOC) or Vulnerability Disclosure Program (VDP).

What happens next is uncertain.

The report may be acknowledged, rejected, classified as informational, or left unanswered. The organization may quietly remediate the vulnerability. Even when the findings are valid and remediation follows, monetary compensation is far from guaranteed, and public recognition may never materialize.

The second individual operates within the cybercriminal economy. Rather than approaching the affected organization, they seek to monetize a vulnerability, compromised access, or offensive capability through an illicit marketplace.

These are not equivalent choices. Criminal activity carries serious legal consequences and causes real harm. But the contrast exposes an uncomfortable economic reality.

Cybercriminals have developed markets in which offensive capabilities are commercial products. Ethical researchers frequently encounter a disclosure system in which the value of their work is recognized only at the recipient's discretion.

Why has the cybersecurity industry allowed this imbalance to persist?

2. Cybercrime Has Become a Service Industry

Modern cybercrime increasingly resembles a sophisticated commercial ecosystem.

On October 14, 2026, Microsoft Threat Intelligence and Microsoft's Digital Crimes Unit published an investigation titled The Hidden Network: Inside the Phishing Infrastructure Ecosystem Powering Global Cybercrime.

The investigation revealed an interconnected ecosystem of phishing-kit developers, infrastructure suppliers, brokers, resellers, and customers.

Microsoft identified an illicit marketplace called YAM Store, tracked as Storm-3119, which supplied compromised or fraudulently obtained cloud infrastructure, including Microsoft and Google environments.

The marketplace supported phishing operations using commercially licensed kits such as CoGUI, Haozi, and Iron Man System.

According to Microsoft's investigation:

The ecosystem included subscription-based phishing services and automated infrastructure provisioning.
Suppliers monetized compromised cloud accounts, credentials, licenses, and storage.
Criminal customers could purchase capabilities rather than develop the underlying infrastructure themselves.
Since January 2026, the phishing kits investigated had facilitated more than one billion phishing emails and SMS messages targeting over 75,000 organizations worldwide.

These findings illustrate something larger than an individual phishing campaign.

They reveal a functioning commercial supply chain for cybercrime.

Infrastructure is acquired, packaged, advertised, sold, and resold. Different participants specialize in different activities. Subscription models create opportunities for recurring revenue. Automation enables operations to scale.

To be precise, Microsoft's report documents marketplaces for phishing services and compromised infrastructure, not a specific market in which individual software vulnerabilities are necessarily sold for negligible prices.

Nevertheless, the economic implication is significant.

The cybercriminal ecosystem has developed mechanisms for converting offensive capabilities into marketable products, complete with suppliers, distribution channels, and paying customers.

The same degree of commercial maturity is not consistently available to researchers seeking to help organizations defend themselves.

3. The Economics of Responsible Disclosure

Independent vulnerability research requires investment.

A researcher may spend substantial time identifying an exposure, establishing its technical characteristics, correlating infrastructure, verifying historical evidence, determining potential impact, and producing actionable remediation guidance.

In complex investigations, discovery itself may represent only a fraction of the total effort.

Consider an investigation involving DNS infrastructure, email authentication, or third-party services. Establishing the security implications may require correlating historical DNS records, infrastructure changes, SMTP attribution, public abuse evidence, and ownership relationships. The researcher bears the cost of that investigation before knowing whether the affected organization will respond. Once the evidence is assembled, another challenge begins: finding someone willing and authorized to evaluate the vulnerability.

A researcher may encounter an unresponsive SOC mailbox, an unfamiliar VDP platform, ambiguous program scope, or a triage process that does not recognize the reported weakness as a conventional vulnerability. Even after a report is accepted, compensation remains uncertain.

There is an important distinction here.

A Vulnerability Disclosure Program is primarily a mechanism for receiving security reports. It is not inherently a commercial agreement. A Bug Bounty Program, by contrast, offers financial rewards for qualifying findings under defined terms.

Organizations are not automatically obligated to pay for unsolicited vulnerability reports. That is reasonable. But it does not resolve the underlying economic problem.

The absence of a contractual obligation to pay does not mean the underlying research has no commercial value.

An organization may receive the benefit of an extensive investigation without having commissioned, funded, or otherwise recognized the work. The researcher, meanwhile, may have invested significant time and resources with no predictable return.

This creates a structural imbalance:

The organization controls whether the findings are accepted, whether remediation is undertaken, whether compensation is offered, and whether the researcher receives public credit.

The researcher bears much of the upfront cost and uncertainty.

There are excellent bug bounty programs that compensate researchers meaningfully. HackerOne's 2026 Security Research Report, for example, reports $89.1 million in bounty payouts during its reporting period.

The problem is not that ethical security research is never rewarded.

The problem is that compensation and recognition remain inconsistent, discretionary, and frequently disconnected from the effort required to produce valuable findings.

4. When Fixing a Vulnerability Is the End of the Conversation

From an organization's perspective, successful vulnerability remediation is often the desired conclusion. The vulnerability is investigated. The relevant engineering team implements a fix. The immediate security concern is resolved. The incident can be closed.

From an external researcher's perspective, however, important questions may remain unanswered.

Was the finding technically validated?
Did the investigation contribute to remediation?
Will the researcher receive acknowledgement?
Is the researcher permitted to reference the work publicly?

These questions concern different outcomes that should not be conflated.

Remediation, validation, compensation, and researcher recognition are four distinct outcomes.

An organization may remediate a reported weakness without confirming its technical validity to the reporter.

It may acknowledge the validity of the findings without offering compensation.

It may provide compensation without permitting public disclosure.

And it may benefit from the research without allowing the discoverer to establish a public record of that contribution.

For external researchers, this final issue is particularly consequential. Recognition is not merely a matter of personal satisfaction. Publicly documented research helps establish professional credibility, demonstrate technical expertise, attract collaborators, and develop commercial relationships.

A researcher who cannot reference their contribution loses an opportunity to convert valuable work into professional credibility. The organization may emerge with improved security, while the researcher receives neither payment nor evidence they can publicly use to demonstrate the value of their work. This imbalance becomes particularly frustrating when even a simple written acknowledgement of the researcher's contribution requires repeated follow-ups.

There are legitimate reasons to coordinate the timing and contents of public disclosures. Confidentiality, customer protection, and remediation windows matter. But these considerations should not prevent organizations from developing transparent, predictable mechanisms for recognizing legitimate contributions. A security team should be able to distinguish between acknowledging the contribution of an external researcher and disclosing sensitive vulnerability details.

A closed vulnerability ticket should not automatically mean a closed relationship with the researcher who discovered it.

5. The Unintended Consequences

Poor incentives do more than frustrate researchers. They can affect whether vulnerabilities are reported at all.

Bugcrowd's January 2026 Inside the Mind of a Hacker report, based on a survey and interviews involving more than 2,000 ethical hackers, highlighted a particularly concerning finding:

65% of surveyed hackers reported having chosen not to disclose a vulnerability because the affected organization lacked a clear, safe reporting pathway.

This statistic deserves serious attention. It does not establish that these researchers sold their findings to criminal organizations. Nor does it demonstrate that financial compensation alone would have changed their decisions. But it reveals a significant weakness in the legitimate disclosure ecosystem. Researchers sometimes discover security weaknesses and decide that reporting them is not worthwhile or sufficiently safe.

The consequences include:

Vulnerabilities remaining unreported.
Delays in communicating security findings.
Researchers disengaging from organizations with poor disclosure practices.
Independent research effort shifting toward organizations offering clearer incentives.
Potentially valuable security intelligence never reaching the teams capable of acting on it.

There is also a longer-term economic consequence. Talented researchers have finite time and resources. If responsible disclosure repeatedly produces uncompensated work, uncertain outcomes, and little professional recognition, researchers have fewer reasons to continue investing in that model. Some may redirect their efforts toward commercial security consulting, organizations with established bounty programs, or other forms of research. Others may simply stop investigating exposures affecting organizations that have no meaningful disclosure process.

This is not evidence that ethical researchers will inevitably turn to cybercrime. It is evidence that the security industry risks losing access to valuable independent research. At precisely the moment when criminal markets are becoming more specialized, scalable, and commercially sophisticated, the legitimate disclosure ecosystem cannot afford to discourage the people working to identify security weaknesses.

6. Building a Better Market for Defensive Research

The solution is not to require every organization to pay for every unsolicited vulnerability report. Nor is it to abandon responsible disclosure in favor of unrestricted vulnerability publication. The opportunity is to build a more predictable, professional relationship between organizations and security researchers. Several practical changes could make a meaningful difference.

Establish clear and safe disclosure channels

Every organization should provide an easily discoverable mechanism for reporting security vulnerabilities.
The policy should define scope, authorized research activities, safe-harbor protections, expected response times, and escalation procedures.
A security contact address that never receives a meaningful response is not an effective disclosure program.

Commit to timely and meaningful communication

Organizations should establish reasonable service-level commitments for acknowledging and evaluating security reports and adhere to the SLAs. A report should not disappear into an indefinite review process. Even when technical investigation takes time, researchers should receive meaningful status updates. A response explaining that a finding is under review, outside program scope, or awaiting another team's assessment is better than silence. It is important to have a meaningful dialogue towards understanding and investigating vulnerabilities.

Recognize legitimate contributions consistently

Organizations should develop formal recognition processes for validated external research.

Recognition might include:

Written confirmation of the researcher's contribution.
Public acknowledgement through a security advisory or researcher recognition page.
Permission to reference sanitized findings after coordinated disclosure.
Attribution in published technical case studies.

Not every researcher wants publicity, and not every finding warrants a public advisory. But recognition should be a defined process rather than an unpredictable favor.

Separate vulnerability reporting from commercial research engagements

Some security findings require considerably more investigation than a conventional vulnerability report. Independent researchers may possess valuable expertise in infrastructure attribution, historical analysis, incident reconstruction, remediation planning, or verification. Organizations should be willing to engage these researchers commercially for additional investigation and advisory services.

At the same time, organizations should not assume that every hour of extended investigation, historical reconstruction, and remediation consulting must be provided free of charge.

Responsible disclosure and commercial security research are compatible activities.

They serve different purposes and should have clearly defined expectations.

Treat external researcher time as a valuable resource

Security organizations routinely allocate budgets for internal engineering teams, external consultants, penetration testing, incident response, and security products. External research can provide comparable value, sometimes by identifying exposures that existing controls and assessments have missed. Compensation should reflect the nature and significance of the work, not merely whether a finding fits neatly into an established bounty category. Where financial compensation is unavailable, organizations should be transparent about that limitation and offer reasonable alternatives, particularly documented attribution and professional recognition.

An organization's internal resource constraints should not automatically become an external researcher's uncompensated cost.

Measure disclosure programs by researcher outcomes as well

A successful disclosure program should not be judged solely by how many reports are received or closed.

Organizations should also evaluate:

How quickly researchers receive meaningful responses.
How consistently valid findings are acknowledged.
Whether remediation outcomes are communicated.
Whether researchers receive credit when appropriate.
Whether contributors would willingly report another vulnerability to the organization.

These measures would help establish whether disclosure programs are building productive relationships with the research community.

A Challenge to Cybersecurity Leadership

The cybersecurity industry has made substantial progress in formalizing vulnerability disclosure. Bug bounty platforms, coordinated disclosure frameworks, and public reporting policies have improved the mechanisms through which researchers and organizations communicate. But providing a reporting mechanism is not the same as creating a sustainable economic model for independent research.

Criminal marketplaces have demonstrated that offensive capabilities can be packaged, distributed, sold, and monetized through sophisticated commercial structures.

Defensive research deserves a more mature approach to incentives. That does not mean equating ethical researchers with criminals. It means recognizing that market structures influence where time, talent, and resources are invested. The cybersecurity industry benefits enormously from researchers who identify weaknesses without being commissioned to find them. It should not take that contribution for granted.

The cybersecurity industry cannot continue to depend on the goodwill of independent researchers while criminal enterprises build increasingly efficient markets for offensive capabilities.

Predictable compensation, professional recognition, transparent processes, and respectful communication are not merely gestures of appreciation. They are investments in an ecosystem that helps identify and eliminate vulnerabilities before they can be exploited.

Ultimately, the question is not whether every vulnerability report deserves a bounty. It is whether organizations are prepared to establish a fair and sustainable relationship with the independent research community.

To CISOs and security leaders:

If you want independent researchers to bring their discoveries to you, what incentives and what guarantees of fair treatment are you prepared to offer them?