Who founded Zerodium and when?

Zerodium was founded in 2015 by Chaouki Bekrar, who previously co-founded the French exploit firm Vupen.

Who can buy from Zerodium?

The company states its clients are government institutions, primarily in Europe and North America, that require offensive cyber capabilities for national security purposes; it does not sell to private corporations or individuals.

Is what Zerodium does legal?

Buying and selling vulnerability research is generally legal in the U.S. and EU, but cross-border transfers of certain intrusion software fall under export-control regimes such as the Wassenaar Arrangement and EU Regulation 2021/821.

Why is Zerodium controversial?

Zerodium is controversial because it stockpiles unpatched vulnerabilities, which critics argue could expose civilian infrastructure to risks, and its role in the offensive cyber tools industry raises ethical concerns.

Zerodium: Private Exploit Acquisition Firm

Zerodium is a private exploit acquisition firm that specializes in purchasing zero-day vulnerabilities from independent researchers and reselling them exclusively to government clients, primarily in North America and Europe. Founded in 2015 by Chaouki Bekrar, Zerodium operates out of Washington, D.C., and has become a prominent player in the cybersecurity landscape due to its transparent pricing model and high payouts for valuable exploits. The company is known for offering substantial bounties, ranging from thousands to millions of dollars, for vulnerabilities in widely-used software, including mobile operating systems like Android and iOS. In 2019, Zerodium made headlines by offering up to $2.5 million for a zero-click Android exploit, highlighting a shift in the perceived security of mobile platforms.

Zerodium's clientele consists of vetted government institutions that require advanced cyber capabilities for national security, intelligence, and counterterrorism purposes. The firm's operations are legal under U.S. and EU laws, although they are subject to export control regulations such as the Wassenaar Arrangement and EU Regulation 2021/821. Despite its legality, Zerodium's business model is controversial. Proponents argue that it provides a controlled, Western-aligned alternative to the grey market, supporting legitimate intelligence activities. However, critics express concerns that the accumulation of unpatched vulnerabilities could endanger civilian infrastructure and potentially facilitate abuses, as seen with other firms in the offensive cyber tools industry. Zerodium itself has not been directly linked to any misuse of its products, but it remains a focal point in debates over cybersecurity policy and the ethical implications of the vulnerability market.

Understanding Zerodium is crucial for those studying cybersecurity policy, international relations, and technology law, as it exemplifies the complex interplay between national security interests and ethical considerations in the digital age. It is a relevant topic for Model UN discussions on cybersecurity and for policy exams addressing technology and security issues.

Zerodium is a vulnerability brokerage founded in 2015 by Chaouki Bekrar, the same entrepreneur behind the French security firm Vupen. Headquartered in Washington, D.C., the company pays independent researchers for previously unknown software flaws — known as zero-days — along with the working exploit code needed to weaponize them. It then packages this intelligence and sells it on an exclusive basis to a small set of vetted institutional customers, which Zerodium publicly describes as government organizations needing capabilities for lawful intercept, intelligence, and counterterrorism operations.

The firm is best known for publishing a transparent price list, an unusual practice in a traditionally opaque market. Payouts have ranged from a few thousand dollars for browser bugs to multi-million-dollar bounties for full remote chains. In September 2019, Zerodium announced it would pay up to US$2.5 million for a zero-click Android exploit, surpassing its iOS bounty for the first time and signaling a shift in the relative hardness of mobile platforms. In May 2020, the company publicly suspended new submissions for iOS exploits, citing a glut of supply.

Zerodium occupies a contested space in cybersecurity policy debates. Defenders argue it provides a legal, Western-aligned alternative to grey-market sales and supports legitimate intelligence work. Critics — including researchers at Citizen Lab and within the Vulnerability Equities Process (VEP) debate in the United States — argue that stockpiling unpatched flaws leaves civilian infrastructure exposed and that the offensive-tools industry, including better-known vendors like NSO Group and Intellexa, has enabled abuses against journalists and dissidents. Zerodium itself has not been publicly linked to specific surveillance abuses, but its business model is central to discussions over export controls under the Wassenaar Arrangement and the EU dual-use regulation (Regulation 2021/821).

Frequently asked questions

Go deeper than the definition

Frequently asked questions

Go deeper than the definition