Data, and whether a moat is possible

Vulnerability data is the one layer of this stack that is genuinely solid and free: OSS-Fuzz, OSV.dev and the ARVO reproduction corpus give anyone a working substrate at zero cost. Everything downstream is weaker than it looks. The commit-mined "vulnerable code" datasets most published detection papers train on overstate model performance by roughly 20x once duplication and leakage are removed. And the data every SOC vendor actually needs — current, labeled alert and telemetry data — simply doesn't exist in public form; the newest widely-used benchmark in that category is eight years old.

#The inventory

#Vulnerability data and feeds

Source	Contains	Size / freshness	License	Access
CVE Program / CVE.org	Canonical vuln IDs	~280k+ IDs; 2025 funding near-lapse, CISA-extended [unsourced]	Free-to-reuse	Bulk download, API
NVD (NIST)	CVSS/CPE/CWE enrichment	Backlog crisis since Feb 2024; ~30,000 pre-2026 CVEs reclassified "Not Scheduled" [unsourced]	Public domain	API, feeds
EUVD (ENISA)	EU vuln database, NIS2 Art. 12	Accelerated 2026 as CVE-funding hedge; status unconfirmed	Unconfirmed	Web UI
OSV.dev	Aggregator, 40+ ecosystems	npm 227,708 / GIT 101,472 / Debian 64,678 / PyPI 24,597	Per-source; schema Apache-2.0	Free API, BigQuery
GHSA	GitHub-curated advisories	Sourced from GitHub, NVD, ecosystem DBs	GitHub ToS	GraphQL/REST, git
CISA KEV	Confirmed exploited-in-wild	Small, hundreds-low thousands, frequent updates	US public domain	JSON/CSV feed
Flashpoint VulnDB	Commercial vuln intel	Broader coverage claimed than NVD	Proprietary	Paid, [unsourced] $50k-$250k/yr est.
Exploit-DB	Public PoC archive	Tens of thousands of entries	Per-submission	Free web + git mirror
Metasploit	Exploit modules	Thousands	BSD-3-Clause core, mixed bundled	Free, git
Nuclei templates	YAML scan templates	~12,000 (6,468 "vuln")	MIT	Free, git

#Bug bounty

Source	Content	Terms
HackerOne Hacktivity	Disclosed reports (opt-in subset)	Platform ToS governs the site, not report content; no bulk-training license [unsourced]
Bugcrowd	"Crowdstream" reports	ToS prohibits "copying, redistribution, use or publication... of any portion of our Website" beyond a revocable access license
Google/Meta/Microsoft VRP writeups	Individual blog posts	Standard copyright; usable under [[regulation-eu|TDM exceptions]] only, no bulk grant

Bug bounty platforms hold the richest source of real, human-verified, severity-labeled vulnerability narratives on the market — and the least legally settled reuse rights of anything here.

#CTF and pwn

Source	Size	License
NYU CTF Bench	200 test + 55 dev, CSAW-derived	GPL-2.0
CTFtime archive	Index across thousands of CTFs	No unified license — an index, not a content host
picoCTF / pwn.college	Educational (CMU / ASU)	Mostly open infra code [unsourced]
DEF CON CTF	The apex competition	No standard license, circulates informally

#Real code corpora and licensing

Source	Size	License mechanics
The Stack v2	67.5TB, ~900B tokens, 104.2M repos, 658 languages	Filtered to permissive SPDX (~60% of collected material); explicit opt-out tool
Software Heritage	>20B files claimed [unsourced exact count]	Metadata CC0; code keeps original license; positioned as lawful-access EU TDM substrate
GitHub public code	N/A	GitHub's ToS self-grants GitHub training rights; does not extend to third-party scrapers, who rely on TDM/fair-use plus each repo's own license

#Threat intel, rules, frameworks

Source	License	Notes
MITRE ATT&CK / CAPEC / CWE / ATLAS	CC BY 4.0 (long-standing position) [unsourced this session]	Free, structured, widely embedded
SigmaHQ	Detection Rule License 1.1	Free, git
YARA / Suricata / Snort rules	Fragmented, per-repo or vendor-proprietary [unsourced]	Mixed free/commercial
VirusTotal	Free consumer; commercial quote-based	[unsourced] five-to-low-six-figures USD/yr est.

#Malware corpora

Source	Size	Freshness	License
EMBER	~1.1M / ~1M PE files, feature-extracted	Repo archived April 2026; content frozen since 2018 [unsourced]	LICENSE.txt present
SOREL-20M	20M samples, ~8TB disarmed binaries	Frozen at 9 Dec 2020 release	Apache 2.0
MalwareBazaar (abuse.ch)	Live feed	Continuously updated	Free non-commercial
VirusShare	Large historical archive	Invite-gated	Ambiguous, community norms

#SOC / telemetry — the biggest gap

Source	Vintage	Assessment
Splunk BOTS v1-3	~2018 [unsourced]	Fixed, memorizable scenario, not live noise
Mordor / Security-Datasets (OTRF)	Ongoing	GPL-3.0 listed; curated/synthetic, not organic traffic
DARPA OpTC	Fall 2019, 500 hosts	Public domain, released with "no obligation... to support additional work" — abandoned
LANL auth/host data	2015 [unsourced]	Anonymized, no payloads, a decade old
CIC-IDS2017 / UNSW-NB15	2017 / 2015	Still listed as current CIC offerings in 2026

#The strong layer: OSS-Fuzz to ARVO to OSV

OSS-Fuzz is Google's continuous fuzzing infrastructure across 1,000+ projects — the substrate nearly every reproducible-vulnerability dataset is built from. Its disclosure repo feeds OSV.dev automatically and is confirmed CC-BY-4.0.

ARVO made OSS-Fuzz bugs actually reproducible end to end — build, trigger, patch-locate. Its current release holds 6,138 security issues, 81% reproduction rate, 89.4% automated patch-location accuracy. One thing is not confirmed: there is no LICENSE file anywhere in the repository. The paper is CC BY 4.0; the dataset/tooling repo is silent on terms. Resolve this directly with the authors before building anything commercial on it.

CyberGym extends the lineage into an agent benchmark — 1,507 real vulnerabilities across 188 projects, whose rigorous construction incidentally surfaced 34 zero-days and 18 previously-incomplete patches. See Cyber benchmarks and evals for how this compares against the rest of the eval landscape.

#The label-noise problem

This is the most important technical finding on this page, and it should change how anyone reads a vulnerability-detection paper.

Most published "AI finds vulnerabilities" training data comes from commit mining: scrape a CVE-fixing commit, label the pre-commit function vulnerable and post-commit safe. PrimeVul tested this pipeline's output by de-duplicating the same data and splitting it chronologically instead of randomly, so a model can't memorize a near-identical sample it already saw. The result: a 7B state-of-the-art model scored 68.26% F1 on BigVul but only 3.09% F1 on PrimeVul. GPT-3.5/GPT-4 under PrimeVul's stricter evaluation performed, in the authors' words, "akin to random guessing." DiverseVul's own authors reached the same conclusion independently: "deep learning is still not ready for vulnerability detection," and more volume doesn't reliably improve generalization to unseen projects.

Why: commit-level labeling assigns "vulnerable" to whole functions where the real fix touches a few lines inside a commit that also carries unrelated refactors, and naive random splits let a model memorize near-duplicate surface patterns instead of learning the vulnerability class.

Implication for training on commit-mined datasets (CVEFixes, BigVul, DiverseVul, MegaVul, CrossVul): not without PrimeVul-style de-duplication and chronological splitting. Implication for reading anyone else's results, including a competitor's marketing claim: assume the number is inflated until the methodology confirms otherwise. Treat this as a standing skepticism filter — see Verification ledger for how many adjacent claims needed similar downgrading.

#The field's real gap: SOC and telemetry data

Every other layer above has some free public substrate. SOC and network-telemetry data has essentially none that's current, per the table above — the field's default benchmarks are 7-11 years old, and both malware-classification anchors (EMBER, SOREL-20M) are frozen mid-decade.

Why this persists is structural, not accidental. Real SOC alert streams and EDR telemetry are full of PII and operational secrets, a literal map of an organization's detection blind spots if leaked, and commercially valuable to the handful of vendors who actually sit on live volumes of it — Splunk, Microsoft, CrowdStrike, Google/Chronicle. None have a structural incentive to release fresh, labeled alert corpora, and no funder has replaced DARPA's mid-2010s appetite for paying academics to build and release this kind of thing.

That is both opportunity and trap. Opportunity: this is the largest data-availability gap in the whole defensive-AI landscape — anyone who fills it credibly has something no incumbent will hand out for free. Trap: the reason no incumbent has filled it isn't oversight, it's that the data is genuinely hard to release responsibly (privacy law, competitive sensitivity, a labeled alert corpus being itself a target list), and a startup attempting the same thing inherits every one of those constraints without an incumbent's legal infrastructure to manage them. Building this without a real anonymization/consent pipeline from day one is a company-ending liability, not a shortcut. See Dual-use risk and what it costs you and EU regulation as a demand engine.

#Legal constraints

GPL/AGPL as training data. Two questions get conflated: is training on copyleft code lawful, and is distributing outputs that reproduce GPL code verbatim lawful. In the US, Doe v. GitHub (filed Nov 2022) is the live, unresolved test — GitHub's defense is fair use; docket status is unconfirmed [unsourced]. In the EU, the DSM Directive's TDM exceptions answer the training question but say nothing about output-side copyleft triggering — untested. Practical read: input-side use is on comparatively solid EU ground under Art. 3/4 (assuming no valid opt-out); output-side memorization is a data-hygiene problem (de-duplicate, downweight memorizable spans), not a "can we use GPL at all" problem. AGPL's network-use trigger for a hosted model is separate and untested.

Bug bounty ToS. Neither HackerOne nor Bugcrowd has published a bulk training license over report content; Bugcrowd's terms forbid reuse beyond a revocable access license. Using narratives for facts is lower-risk; reproducing PoC code or full report text verbatim, especially in a redistributed benchmark, is not covered by anything either platform has published.

Redistributing exploit code in a public benchmark. Not primarily a copyright question — PoC exploit code has thin, functional-only copyright, and the community treats open publication against disclosed, patched vulnerabilities as norm-compliant (ARVO and CyberGym both do exactly this). The live risks are coordinated-disclosure norms and dual-use export control: some intrusion tooling can fall under Wassenaar-derived controls (EU Dual-Use Regulation 2021/821) — more about C2-capable tooling than static PoC crash triggers, but a lab publishing a large weaponized-exploit corpus should get export-control counsel involved. See Dual-use risk and what it costs you.

The German TDM opt-out gray zone. This is genuinely unresolved, not a loophole. DSM Directive Article 4 lets rightsholders opt commercial TDM out via Recital 18's "machine-readable means, including... terms and conditions of a website" — language that, read loosely, could cover a prose ToS clause. Germany's UrhG §44b is stricter: "Ein Nutzungsvorbehalt bei online zugänglichen Werken ist nur dann wirksam, wenn er in maschinenlesbarer Form erfolgt" — an opt-out is only effective in machine-readable form. The safer reading is robots.txt-style directives or TDMRep metadata, not prose. Most bug-bounty ToS (Bugcrowd, HackerOne) are prose. A strict reading could treat Article 4/§44b as still legally open on those sites, even though the platforms clearly don't want scraping — contested, untested by any actual ruling. The EU AI Act's Article 53(1)(c) obligation for GPAI providers to comply with Article 4(3) opt-outs [unverified exact article number] means relying on this reading needs an actual compliance policy, not a footnote.

#Moats: what compounds and what doesn't

Four candidate proprietary data types, ranked by whether they structurally compound — a widening advantage the more the product is used — versus merely accumulate as a static pile a funded competitor could replicate.

Customer code + fix outcomes (Snyk, Semgrep, CodeQL). Weakly compounding: Snyk's own claim of 3,506 personally-disclosed vulnerabilities, fresh as of 27 July 2026, is a real flywheel, but it's discovery labor any well-funded competitor can also hire for — a moat built on spend, not scale-only data.

Agent trajectories — an agent attempting a task, succeeding or failing, with the full action trace. Structurally different: no public corpus of this exists at real scale for security (CyberGym, NYU CTF Bench, R2E-Gym/SWE-smith are static task sets, not live logs). A lab running its own agents against real bug bounty programs or customer codebases accumulates a trajectory corpus that only exists as a byproduct of running the product — the one category that genuinely compounds.

Verified exploit/patch pairs beyond OSS-Fuzz/ARVO — high value only for closed-source/enterprise code, since open source is already covered free. Requires already having deployed customers, a chicken-and-egg problem for a new entrant.

Human-labeled triage decisions (true/false positive, severity, by real analysts). Semgrep's own marketing claims exactly this flywheel: Multimodal "reduces the number of findings you need to triage by 20% the day you turn it on," improving as it learns — the strongest publicly stated evidence here that an incumbent believes triage data compounds.

Trajectories and triage labels compound because both are byproducts of usage; customer code and exploit/patch pairs are spend- or access-driven and replicable without an existing product. The uncomfortable implication: the two moat-worthy types are exactly what a pre-launch lab cannot yet have — they need a live product loop first. This argues for a narrow wedge product purely to start the flywheel, not out-licensing the static-data incumbents. See What could actually be defensible and Unit economics and the compute bill.

#Three candidates for a small European lab in 2026

A — a live agent-trajectory corpus over real bug bounty engagements, run with program consent. Compounds hardest, but requires agents already in the field — the right eventual asset, not the right first one.

B — a European-jurisdiction-native SOC/EDR telemetry corpus with consented, anonymized labels from EU mid-market partners, using GDPR-native tooling as a selling point.

C — verified exploit/patch pairs for underrepresented stacks (Java/Kotlin enterprise backends, EU-common OT/ICS protocols). Real but narrower gap, and the PrimeVul lesson applies: more commit-mined data without fixing methodology mostly reproduces the noise problem.

Argument for B. The SOC gap is the most severe and stagnant one in the inventory, and incumbents who sit on live data have no incentive to publish fresh corpora — a startup competes against a vacuum, not an alternative. It plays to a real European comparative advantage (GDPR-native consent tooling, the EU's own AI Act/TDM scaffolding as legal basis). Unlike A, it doesn't need an existing agent product to start — data-sharing agreements with a modest number of consenting SOC customers is more tractable than displacing HackerOne or out-competing Snyk's research team. And it's useful as both training data and eval benchmark — the CIC-IDS/UNSW-NB15 replacement the field visibly needs. See Where the gaps actually are, AI SOC and detection companies, and Who buys, and what they pay.

#Cost to build a 10k-task verifiable security training set

Grounded in comparable public efforts, not a top-down guess. SWE-smith produced 50,000 task instances from 128 repos with a small academic team, noting prior manual curation needed "hundreds of hours of human labor" for far smaller sets — automated synthesis is roughly an order of magnitude cheaper per task once execution-environment tooling exists (arXiv:2504.21798). R2E-Gym produced 8.7k tasks similarly (arXiv:2504.07164). ARVO's hard part wasn't finding vulnerabilities — OSS-Fuzz already found them — it was building rebuild/bisection infrastructure robust enough to hit 81% reproduction across 311 build systems.

Reasoned estimate for a 10k-task, execution-verifiable benchmark built on top of existing free substrates rather than from zero:

• Infrastructure (build/rebuild pipeline, bisection, patch-verification oracle): comparable to ARVO at ~1.6x its task count → 6-12 engineer-months, leaning on OSS-Fuzz's build definitions.
• Synthetic scale-up (SWE-smith/R2E-Gym-style mutation and back-translation): 4-8 engineer-months, contingent on the infrastructure above.
• Human verification/QA — non-optional given PrimeVul: de-duplication, chronological splitting, expert review. At 15-30 minutes per task across 10,000 tasks: 2,500-5,000 analyst-hours, ~15-30 engineer-months, or $200k-$750k contracted at $80-150/hr loaded.
• Compute: minor on OSS-Fuzz's own infra (tens of thousands); $50k-$300k if built independently.

Total: roughly 25-50 engineer-months and $500k-$2M all-in — but only within automatically-verifiable memory-safety/crash-class bugs, where a sanitizer trip or crash reproduction already exists as an oracle. Classes without one — business logic flaws, authn/authz bypass, misconfiguration, SSRF chains — remove the synthetic-scale-up savings and make verification fully human-expert-dependent, plausibly doubling or tripling the cost. See AIxCC: the closest thing to a proof, Post-training playbook, and Open questions and the research backlog.

#What this means for us

• Do not build a "vulnerability detection from commit data" product on BigVul-lineage datasets without PrimeVul-style de-duplication and chronological splitting — the field's own numbers show a ~20x collapse under honest evaluation.
• OSS-Fuzz/ARVO/OSV already covers the open-source reproducible-vulnerability layer well and free; don't re-derive it. Resolve ARVO's license question with the authors before building anything commercial on it.
• The SOC/telemetry gap is the biggest real opportunity here, and it's hard by nature, not by neglect — a credible entry needs a consent/anonymization pipeline as a first-class feature from day one.
• Bug-bounty and GPL/AGPL data are usable in principle but gray in ways that matter for a lab planning to redistribute a benchmark or sell a trained model in the EU — get current counsel on the German machine-readable-opt-out question before scraping ToS-protected content at scale.
• Don't chase a static-data moat (customer code, scraped exploit archives) — those are spend-replicable. If a data moat is the long-term bet, the wedge product must exist first, since trajectories and triage labels only accumulate as a byproduct of real usage.
• A 10k-task verifiable benchmark is a $500k-$2M, 25-50 engineer-month undertaking within the memory-safety class, and meaningfully more outside it — budget accordingly.