Zero-Day Markets Are Booming. Defenders Are Losing the Price War

The economics of exploitation

A single zero-click iPhone exploit chain now fetches up to twenty million dollars on the gray market. That figure has tripled in three years, driven by demand from state actors and the increasing difficulty of breaking modern mitigations.

Why defense keeps losing

A defender must close every hole; an attacker needs one. But the deeper problem is economic: a researcher who finds a critical bug can earn 100x more selling it privately than reporting it through a bug bounty. The incentive structure is fundamentally broken.

The new playbook

Leading security teams have stopped trying to win the price war. Instead they are investing in detection depth — assuming compromise and instrumenting everything. Memory-safe languages, hardware attestation, and aggressive compartmentalization are turning single exploits into dead ends.

What comes next

Regulation of exploit markets is coming, but slowly. Until then, the best defense is making exploitation expensive enough that attackers move on to softer targets.