This question is about the economic model employed by NSS with their ExpoitHub exploit marketplace (site link) and whether it jives with the white hat claims of the company. The company has made news this month by offering bounties of hundreds of dollars for weaponizing a dozen known vulnerabilities (company offer).
This business model seems to be a variation of the long awaited Holy Grail solution of creating a marketplace for the good guys which will be self-perpetuating and a win-win for all interested in enhanced security. The company quotes H.D. Moore (first link above) and others in support of the concept. His quote suggests this weaponizing activity is benign because it is only focused on non-zero-day vulnerabilities. In the press eEye’s CTO Marc Maiffret (link) provides a more negative comment along the same line of thought "If you are a company getting exploited by known vulnerabilities, your security is not doing its job.”
NSS states is that only 1,000 of 15,000 to 17,000 known critical vulnerabilities have exploits available in Metasploit and that this gap presents a great opportunity for exploit writers to support the pen testing community. The site itself is offering the exploit authors 30% of the revenue and selling unverified exploits for as much as $1,500 each.
Who would pay $1,500 for a single specific exploit? Wouldn’t a simple security audit identifying the vulnerability serve the same purpose passively as a third party penetration tester demonstrating the weakness actively with his purchased attack? If that is the case then is it time to suggest that folks purchasing such exploits might not be wearing such white hats or am I missing something important?