^ so do outfits like f secure get paid by these companies for finding exploits or are they kind of blackmailing them when they find vulnerabilities ?