[_bxg1]

I wouldn't lump Correlium in with the companies that hoarde and sell actual vulnerabilities. Tools that allow people to find them go both ways: they can equally be used to exploit and to harden a system. It's unclear which direction Correlium favored, if either, but there's at least the potential that it could be used for good.

What Apple needs to do, IMO, is release their own version of this for free and set up a well-funded bug bounty program (lord knows they have the cash). When you have to buy the tool from a third-party, it seems like wealthy bad actors will be more likely to do so than people with good intents.