This is pretty much why I think all VEP are just smokescreens gchq.gov.uk/features/equit… (1/?) 
The whole process is done in secrecy, there are no publicly available statistics about the vulnerabilities being kept
These are intelligence agencies, they know how disinformation works and how to keep information confidential. There is zero guarantee all vulnerabilities will go through VEP. Some of them might be compartmentalized to upper classification and only known to a few.
Don’t get me wrong, this is a good move but overall nothing has really changed, offensive capabilities will always be more « strategic » than defensive ones
Especially if you can detect your own 0days in the wild, you can protect (= detect) the vulnerabilities and at the same time exploiting them as 0days: getting the best of both worlds
They try to make it look like it's a boolean question: whether we disclose it and protect or just use it against targets. But this is not as simple! You can both keep it to yourself AND detect it when used against you.
