The market for exploits is far cheaper than the cost of defense against them. It seems like firms would be better off hiring real black hats to make real exploits than mess with white hat firms.