&gt; <i>What other option do these researchers have? Try to sell the vuln on the black market (illegal)</i><p>That&#x27;s probably what GP is alluding to. They do have this option and I can imagine they could get <i>much</i> more money this way, with little or no way to trace the source of a 0day back to them.<p>&gt; <i>Companies are under no obligation to pay and researchers are under no obligation (except ethics, I guess) to turn over their findings. By having some non-trivial payment the companies are encouraging people to provide cheap sec audits for them.</i><p>Well, of course. The question is, whether the amount companies chose to pay is enough to get most people to report vulnerabilities instead of selling them elsewhere, or if those companies are just putting a lot of trust in the strong morals of security researchers?