The complexity of 2 will very much depend on what 1 is, surely

@PhilLello, sure, but I'm asking about the average case. For instance, if we looked at a company that develops exploits, in aggregate, would we expect more of its budget to go towards 1, or towards 2?

I'd lean towards 1

I feel you are making a distinction where no distinction exists. Weaponizing depends on prior experimentation, and search is aided by the information gleaned from experiments.

it depends on stage 1, but usually stage 1 costs a little more due to the higher skill required

@AlexeyVesnin A little more? Well, sounds nonsense.

a little means less than 10%

@AlexeyVesnin Still nonsense.

@Saibot it seems that you are completely out of experience with software project management, especially with economical details. The question - as it stated - is reasonable, understandable - but too broad/undetailed to put some amounts on a table. With this question details no more detailed answer is possible.

@Saibot there are end-users for exploits, for a sets of exploits, etc. Even a legal ones, by the way. And any software development cycle costs resources and money. You can sell ZeroDay exploits, including legal cases! And a customers are not just the software vendors only, by the way - please read some more, you will see it yourself

@AlexeyVesnin Exploits, are for exploiting, no need to be user friendly, no need for a GUI either. What software development cycle are you talking about? It's a super developer thing, not a team work. Nobody asks for help for it: "Hey, I found a critical vulnerability, would you like to help me to write an exploit?" And it's not 0-day anymore... Even arguing this is nonsense.

To all the commenters...Speculation is not helpful. If there is reliable data or studies that can be referenced, that would be useful for an answer.

@Xander This is not a speculation. If you are a programmer, you know the difference between developing a big software for end-users and developing a quick dirty command line interface tool. Please go to exploit-db.com and check exploits. Average code length is 200 lines. Probably you can't find any exploit more than 1000 lines. Once you find the vulnerability, if you are experienced in programming, it just takes a bit time write an exploit.

@Saibot And if you were a programmer, you would know that LoC is a useless metric for measuring code complexity, or the skill level or cost to develop. Your perspective is valid, but naive. The true equation is far more complicated, otherwise the question wouldn't need to be asked.

@D.W. I never heard such thing as "a company that develops exploits". What is it? :)

@Xander I tried to explain in other metrics, but you find it speculative. Again, building a cli tool, or a script for exploiting is easy and takes not much time generally. But if you want something concrete, use LoC then.

@Saibot Read the literature on postmortems of high-profile attacks. There are a number of groups and government contractors who have exploit development as a line of business.

@Xander Don't do speculation, provide reliable data and studies that can be referenced, please.

@xander strongly agree! There are The Hacked Team as a shiny example. And the Shadowscan from a deep past can be a real example of exploit pack that had a GUI and sold nicely

@AlexeyVesnin Sold nicely? We are talking about 0-days, how can it be a 0-day if they are selling it publicly? I'm really waiting for someone sensible to post a comment on this...

@Saibot it seems you're living in a pink ponies world.. Yes, 0-days are for sale, and if you don't know the place where they are traded - it does not means that it does not exists. Wake up!

@AlexeyVesnin They can be for sale, but you can't buy one. They are not for sale publicly. You are just a joke...

@Saibot actually I can, if I want to - I have some entry points ;) It's you a joker playing a "straightforward-and-only" way of life. If you was not invited to a private places - it means that you're not worth to enter them, not that they does not exist. Get a grip, man! You need a straight reality check right now. No offense - just a flat facts

@Saibot - I already warned you: Be Nice!

@AlexeyVesnin - also to you - name calling is unnecessary