The gray market price signal is the part worth sitting with. If discovery got cheaper, more people should be finding the same bugs and rarity should collapse the price. Prices going up instead means the cheap layer, memory safety, off by one, got flooded while the bugs that actually chain into something exploitable stayed just as scarce, and now more people with cheap tooling are chasing that same shrinking pool. The diligence question for any vendor selling AI powered vuln discovery isn't the CVE count, it's what fraction of submitted patches get accepted unmodified by the maintainer versus reworked or rejected. That's the yield number that tells you whether triage and verification are real or just a nicer looking report.
The gray market price signal is the part worth sitting with. If discovery got cheaper, more people should be finding the same bugs and rarity should collapse the price. Prices going up instead means the cheap layer, memory safety, off by one, got flooded while the bugs that actually chain into something exploitable stayed just as scarce, and now more people with cheap tooling are chasing that same shrinking pool. The diligence question for any vendor selling AI powered vuln discovery isn't the CVE count, it's what fraction of submitted patches get accepted unmodified by the maintainer versus reworked or rejected. That's the yield number that tells you whether triage and verification are real or just a nicer looking report.