do you mean they pay companies to put backdoors into products? or you mean they just go hunting for vulnerabilities. maybe both?