In the eyes of some security professionals, Immunity and Netragard themselves are far from saintly: Neither company reports all of its vulnerabilities to the software's manufacturer upon acquiring them, since doing so would devalue the bugs they purchase.