Yago Hansen, a Spanish hacker with experience in the sector, explains how the exchange works: “You tell the vulnerability to these companies and they assess it according to the exploitation capacity it has.” When the company acquires the vulnerability, it turns it into an exploit, a malicious program to take advantage of the discovered flaw, and incorporates it into its commercial offer.