The U.S. Government and Zero-Day Vulnerabilities(jia.sipa.columbia.edu)

https://jia.sipa.columbia.edu/online-articles/healey_vulnerability_equities_process