Exploit Acquisition Program
Vanguard Intelligence continuously evaluates high-quality vulnerability research and exploits from independent researchers. Submissions are handled confidentially and reviewed by people who understand the work.
Terms are agreed before any technical details are shared.
Current Areas of Interest
Priorities change over time. If your work falls outside this list, you are still welcome to reach out.
- Full-chain mobile exploits — iOS and Android.
- Modern Windows — remote code execution and privilege escalation.
- Browser full chains — Chrome, Edge and Safari.
- Enterprise, cloud, VPN and security products — vulnerabilities in widely deployed systems.
- Weaponized exploits for recent and emerging CVEs.
What we look for
The criteria we use to assess incoming research.
- Reliability and stability across the supported configurations.
- Clear documentation that lets our team reproduce and assess the work.
- Realistic target versions that reflect what is deployed in the field.
- Minimal false positives and predictable behaviour.
We evaluate submissions quickly. Compensation is competitive and based on quality, impact and exclusivity.
Four steps, clearly defined
No technical details are requested until terms are agreed and a secure channel is in place.
Initial contact
Send a short, non-technical description through the contact form or by encrypted email.
Preliminary review
We confirm whether the research matches our current interests and propose terms.
Technical evaluation
Under agreed terms, our team reviews and validates the research and its documentation.
Agreement
Final terms are confirmed in writing, followed by a secure handover and settlement.
Discretion is part of the process, not an add-on.
Confidentiality applies from the first message — whether or not we proceed.
- Encrypted communication: PGP-encrypted email and secure channels for all technical material.
- Need-to-know access: submissions are seen only by the staff directly involved.
- Identity protection: never disclosed to third parties without your consent.
- Minimal retention: material from declined submissions is not retained or used.
Frequently Asked Questions
What should my first message include?
A brief, non-technical introduction: who you are, the general area of your research and how we can reach you securely. Please do not include technical details or attachments.
Do I need to use PGP?
It is strongly preferred. Write to contact@vgintel.live and encrypt with the public key on the Contact page. If you include your own public key, we will reply encrypted.
When are technical details shared?
Only after the preliminary review, once terms are agreed in writing and a secure channel is established.
How long does the review take?
It depends on the research. We confirm expected timelines at the preliminary review stage and keep you informed throughout.
What happens if you decline a submission?
We let you know, and any material you shared is not retained or used. Confidentiality obligations still apply.
Will my identity be disclosed?
No. Your identity is never disclosed to third parties without your explicit consent.
My research is outside your current areas of interest. Should I still write?
Yes. Priorities change over time, and we review every inquiry.
Ready to start?
Use the contact page to send a brief introduction. Please do not include technical details in your first message.
Confidential from the first message