Buyers cannot see how secure software is, so economists proposed ways to attach a price to it: bounties and vulnerability markets, derivatives on software quality, and insurance. Each gives some signal. Each also has a catch, so none replaces testing and evidence.
Why a price helps
If you can see what it costs to find a flaw in a product, you learn something about its strength. Anderson and Moore note that some standards already specify a minimum cost of compromise, such as banking standards for point of sale terminals.
Bounties and markets
The paper cites Donald Knuth, who offered rewards to people who found bugs in his typesetting software, and Mozilla, which at the time of writing offered US$500 for critical Firefox flaws. Camp and Wolfram suggested markets might work better, and Schechter proposed open markets in reports of undiscovered vulnerabilities. The authors report that two firms were openly buying vulnerabilities, though prices were not published.
They name a catch: a firm that sells vulnerability data to subscribers could increase its product's value by leaking information that harms non-subscribers. They also note a general criticism of market approaches: motivating more people to look for flaws may raise the number of identified vulnerabilities, so design matters.
For the practical side of a bounty program, see bug bounty readiness and how to decide payouts.
Software derivatives
Bohme suggested contracts issued in pairs. One pays a fixed amount if no vulnerability is found in a program by a set date, the other pays if one is. If traded, the price would reflect the consensus on software quality. Vendors, investors and insurers could use them to hedge. This is a proposal in the literature, not a common market.
Auctions
Ozment proposed designing a vulnerability market as an auction, which the paper says a Swiss firm had implemented.
Insurance
Underwriters often use expert assessors to inspect a client's IT infrastructure and management, which gives data to both insured and insurer. Over time insurers should learn to value risks better. The authors say the cyber insurance market was underdeveloped and underutilised, partly because of risk interdependence. See moral hazard in cyber insurance.
What a buyer can do now
None of these gives you a clean price. Use their logic:
- Ask what it would cost an attacker to break the product, and what evidence supports that.
- Look at the vendor's disclosure and fix record.
- Run your own tests on your own code.
- Treat insurance terms as one more signal, not a certificate.
Quick check
What risk do critics see in vulnerability markets?
They may motivate more people to hunt for flaws, raising the number of identified vulnerabilities, and sellers might leak data to harm non-subscribers.
Are software derivatives a common market today?
The paper presents them as a proposal. Do not assume a liquid market exists.
Sources
Last reviewed: 19 October 2026.
