https://www.sorinmustaca.com/isc2-blog-post-vulnerability-disclosure-a-new-business-model/