Atlantic Council: US cyber power is hampered by an inefficient supply chain for zero days, with too few providers and “levels of middlemen” driving up costs
Atlantic Council research says market for zero days is bloated, leaving the US behind rivals such as China. — The Cyber Angle Bluesky: @patrickhowelloneill.com Bluesky: Patrick Howell O'Neill / @patrickhowelloneill.com : Giant defense contractors as rent seeking middlemen who can extract value even when they contribute little to nothing or a story about how the United States buys zero-day exploits www.bloomberg.com/news/newslet...
Context & Ripple Effects
The zero-day trade evolved from a niche broker ecosystem into an input to espionage, crime and military planning, as earlier reporting on the exploit-broker market's maturation documented. U.S. use also preceded a formal policy framework, according to coverage of its pre-policy use of zero days.
Atlantic Council’s finding matters because it shifts attention from access to exploits alone to the procurement path: supplier concentration and intermediaries can determine whether cyber capability is acquired efficiently.
First-order effects
- U.S. cyber buyers face higher costs and slower access to zero-day exploits when a small provider base is mediated by multiple contracting layers.
- The report puts pressure on the defense-contractor and broker role in exploit procurement, particularly where intermediaries add cost without clear technical contribution.
Second-order effects
- A costly, slow acquisition channel can weaken the United States’ ability to translate available vulnerability research into operational capability relative to rivals the report identifies, including China.
- Demand for more direct sourcing or a broader provider base could alter bargaining power among exploit researchers, specialist vendors, brokers and prime contractors.
Third-order effects
- If the pattern persists, zero-day procurement becomes a strategic supply-chain problem rather than solely an intelligence or technical one: market structure can constrain state cyber capacity.
- The case reinforces a wider need for procurement systems that balance access to scarce offensive capabilities with oversight; earlier policy gaps around U.S. zero-day use show those objectives do not automatically align.
The trend: Offensive cyber capability is increasingly shaped by the resilience, concentration and governance of the specialized markets that supply it.