Vulnerability research, exploit brokerage and operational use sit on one supply chain, and clumsy regulation treats them as one activity. The result is chilled disclosure and untouched grey markets.
Regulate the transaction, not the knowledge
Controls aimed at sale-for-operational-use — rather than at research, tooling or disclosure — target the actual harm while leaving the defensive ecosystem intact. Precision here is not a concession to industry; it is what makes the rules enforceable.