Vupen
| Company type | Private |
|---|---|
| Industry | Information security |
| Founded | 2004 |
| Defunct | 2015 |
| Fate | Company closed; founders started Zerodium |
| Headquarters | Montpellier , France |
Area served | Worldwide |
| Products | Zero-day software vulnerabilities and exploits |
Vupen Security was an information security firm originating from France, established in 2004 and headquartered in Montpellier, with an additional office located in Annapolis, Maryland in the United States. The company concentrated on identifying zero-day software vulnerabilities affecting prominent software providers, which it then sold to law enforcement and intelligence agencies for use in both defensive strategies and offensive cyber operations. Operations ceased in 2015, after which the original founders initiated a new venture known as Zerodium.
Work
From 2011 through 2014, Vupen secured first place multiple times at the renowned hacking competition Pwn2Own, including a notable exploit of a flaw in Google Chrome during the 2012 event. The firm's decision to commercialize discovered vulnerabilities instead of publicly disclosing them generated debate within the cybersecurity community. Despite this, at Pwn2Own 2014, Vupen provided full disclosure of all exploits and technical information to affected companies such as Google, prompting subsequent security patches from industry leaders like Adobe, Microsoft, Apple, Mozilla, and Google.
Initially, Vupen offered vulnerability data without charge but transitioned to a paid model later on. According to founder Chaouki Bekrar, "The software companies had their chance; now it's too late." Reports in 2013 revealed the NSA as a subscriber to Vupen's exploit services, while in 2014, Germany's BSI security agency was also listed among its clients. Furthermore, between 2010 and 2011, Vupen provided exploits to the Italian company Hacking Team.
On 5 May 2015, the founders of Vupen officially filed for company closure and moved their operations to the United States to launch the cybersecurity enterprise Zerodium.
Zerodium
On 23 July 2015, the same founders introduced Zerodium in the US market, implementing a unique business approach centered on purchasing zero-day exploits from independent security researchers. This organization markets these vulnerabilities alongside defensive solutions and security guidance exclusively to government entities.