[wjnc]

I think we imagine them to sell mostly consulting and re-using those 0-days on thousands of unconnected victoms bringing in many millions for a billion dollar valuation. This is somewhat in jest, but goes to show that the value of the zero days themselves doesn’t necessarily impact valuation much. That’s just an asset. It’s the business they have on top of that and the value it extracts that determines the free cash flow that an investor would hit with a multiple.

[Veserv]

Huh? Given their valuation, their business is barely worth more than their zero-days which are just not very expensive.

People have the mistaken belief that total security compromises are challenging or expensive leading them to the mistaken belief that these companies must be valuable with valuable assets and high revenue.

Hacking-for-hire is barely more than a commodity, like aluminum smelting. There are capital costs, you need technology and expertise, but it is highly fungible leading to lots of suppliers competing on cost and quality of service (turn key, white-glove, etc.) Hell, it is even cheaper to get into and stay on top than aluminum smelting since the capital costs are so much lower.