A zero-day vulnerability is a software flaw unknown to the vendor. Specialised researchers discover these bugs, then sell them through brokers to government buyers. Prices can range from tens of thousands of euros to well over a million depending on the target software and the exploit's reliability. This grey market operates largely outside public view, creating a supply chain for offensive cyber capabilities.