For the complete documentation index, see llms.txt.Skip to main content
Crowdfense is a UAE-based vulnerability research firm that specializes in acquiring zero-day exploits from independent researchers and reselling them to vetted government and institutional clients. Operating in the "gray market" for software vulnerabilities, Crowdfense purchases previously unknown security flaws, known as zero-days, and full exploit chains. The firm gained significant attention in 2018 when it launched a $10 million acquisition program targeting high-impact exploits for mobile and desktop platforms. As of April 2024, Crowdfense's price list offers up to $5–7 million for full-chain, zero-click remote code execution exploits on iOS and Android devices, with lower prices for other types of vulnerabilities. This transparency in pricing is rare in the industry and serves as a benchmark for the value of offensive cyber capabilities. Unlike companies such as Zerodium and NSO Group, Crowdfense primarily acts as a broker and quality-assurance entity rather than developing surveillance products. Researchers submit exploits through a vetting process, and Crowdfense validates these technical claims before making payments. The firm's activities are central to ongoing debates about the ethics and regulation of the commercial zero-day market. Critics argue that this market facilitates state surveillance against vulnerable groups, while supporters claim that regulated brokers like Crowdfense prevent vulnerabilities from reaching less accountable buyers. The UAE location of Crowdfense also raises concerns due to the country's history with commercial spyware. The firm operates under legal frameworks such as the Wassenaar Arrangement, which regulates the export of intrusion software, though enforcement varies by jurisdiction. Crowdfense's role in cybersecurity and its implications for international relations make it a relevant topic for policy researchers, Model UN participants, and exam candidates focusing on tech governance and cybersecurity policy.
Crowdfense is a private exploit-acquisition company headquartered in the United Arab Emirates that operates in the so-called "gray market" for software vulnerabilities. It purchases previously unknown security flaws — known as zero-days — along with full exploit chains from independent researchers, then resells them to a restricted client base it describes as government and institutional customers.
The firm became publicly visible in 2018 when it announced a $10 million acquisition program for high-impact exploits targeting mobile and desktop platforms. In April 2024 it published an updated price list offering up to $5–7 million for full-chain, zero-click remote code execution on iOS and Android, with lower tiers for browser, messenger, and operating system bugs. These public bounty tables are unusually transparent for the industry and are frequently cited by security journalists as a benchmark for the going rate of offensive cyber capabilities.
Crowdfense positions itself as a competitor to firms such as Zerodium (founded by Chaouki Bekrar) and NSO Group, though its business model differs: it acts primarily as a broker and quality-assurance layer rather than a developer of finished surveillance products like Pegasus. Researchers submit candidate exploits through a vetting process, and Crowdfense validates the technical claims before payment.
The company sits at the center of ongoing policy debates relevant to IR and tech-governance researchers. Critics — including organizations such as Access Now and Citizen Lab — argue that the commercial zero-day market enables state surveillance against journalists, dissidents, and diplomats, and that export controls under frameworks like the Wassenaar Arrangement (amended in 2013 to cover intrusion software) are inconsistently applied. Defenders argue that without regulated brokers, vulnerabilities would flow to less accountable buyers. Crowdfense's UAE base also draws scrutiny given the Emirates' own documented history as a customer of commercial spyware.
Yes. Brokering vulnerabilities is legal in most jurisdictions, though exports of intrusion software are regulated under the Wassenaar Arrangement and national laws such as the EU Dual-Use Regulation.
Traditional bug bounties (e.g., from Apple or Google) pay researchers to report flaws so vendors can patch them. Crowdfense instead sells working exploits to government clients, meaning the bugs typically remain unpatched.
The company has not published a client list. It states it sells only to vetted institutional buyers, generally understood in the industry to mean intelligence and law-enforcement agencies.
Crowdfense is controversial because it sells zero-day exploits to government clients, raising concerns about state surveillance and the ethical implications of the commercial zero-day market.