Zero Day Initiative (ZDI)

Background

The Zero Day Initiative (ZDI) is a vulnerability purchase and coordinated-disclosure program that was started on July 25, 2005 by TippingPoint, at the time a division of network-equipment maker 3Com. TippingPoint sold intrusion-prevention systems and had a commercial incentive to learn about unpatched ("zero-day") software vulnerabilities before they were exploited in the wild, so it could add protective filters for its own customers ahead of a public patch. ZDI was created to formalize this by paying independent security researchers for vulnerability information, verifying the flaws internally, and then coordinating disclosure with the affected vendor rather than publishing exploit details or selling them to third parties. The program was initially led by David Endler and Pedram Amini.

Ownership changes

ZDI's corporate ownership has changed hands along with its parent company. 3Com had acquired TippingPoint in January 2005 for roughly $442 million. When Hewlett-Packard (HP) acquired 3Com in April 2010 for approximately $2.7 billion, TippingPoint and ZDI became part of HP's enterprise security business. In October 2015, Trend Micro acquired HP TippingPoint, including the ZDI program, in a deal reported at roughly $300 million. ZDI has operated under Trend Micro ever since, run alongside the company's broader threat-research organization.

Program model

ZDI's core model is to pay researchers a bounty for a validated vulnerability report, under agreements that the flaw will not be disclosed publicly or sold elsewhere until the vendor has had an opportunity to patch it. ZDI itself notifies the affected vendor, tracks the case, and eventually publishes an advisory once a fix is available or after a disclosure deadline lapses. This vendor-agnostic structure, covering products from many different companies rather than a single vendor's own bug bounty, distinguished ZDI from most first-party bounty programs and let it aggregate large volumes of vulnerability research across the industry. By the mid-2010s, ZDI was consistently ranked as one of the largest external sources of publicly disclosed vulnerabilities affecting major vendors such as Microsoft and Adobe.

Pwn2Own

ZDI is closely associated with Pwn2Own, a hacking competition first held in March 2007 at the CanSecWest conference in Vancouver. Pwn2Own was conceived by security researcher Dragos Ruiu, originally as a contest targeting Apple's Mac OS X after Ruiu grew frustrated with Apple's public statements about the platform's security. From the contest's first running, ZDI (represented by TippingPoint researcher Terri Forslof) participated by offering cash rewards for vulnerabilities demonstrated live against target software, aligning the contest's public exploit demonstrations with ZDI's disclosure-and-purchase model. Pwn2Own expanded in subsequent years to cover web browsers, mobile devices, virtualization software, and industrial control systems, and continues to run multiple times per year under ZDI/Trend Micro sponsorship.

Scale and legacy

Over two decades ZDI grew from a single-vendor incentive program into what Trend Micro describes as the world's largest vendor-agnostic vulnerability disclosure program, drawing submissions from a large international community of independent researchers and crediting thousands of disclosed vulnerabilities across widely used software. Its combination of paid vulnerability acquisition, coordinated vendor disclosure, and a public showcase event in Pwn2Own has been cited as an influential model for how the security industry incentivizes responsible reporting of software flaws, standing in contrast to unregulated markets for exploit sales.

Timeline

• 2005-013Com acquires TippingPoint for approximately $442 million.
• 2005-07-25TippingPoint launches the Zero Day Initiative (ZDI), initially led by David Endler and Pedram Amini, to pay researchers for vulnerability reports and coordinate vendor disclosure.
• 2007-03ZDI/TippingPoint begins sponsoring the newly created Pwn2Own hacking contest at CanSecWest in Vancouver, offering cash prizes for live exploit demonstrations.
• 2010-04Hewlett-Packard (HP) acquires 3Com for about $2.7 billion, bringing TippingPoint and ZDI under HP ownership.
• 2015-10-21Trend Micro acquires HP TippingPoint, including the ZDI program, for roughly $300 million.
• 2016ZDI is reported as a top external source of publicly disclosed vulnerabilities for both Microsoft and Adobe.