How Washington evaluates software vulnerabilities

In August, the National Security Agency (NSA) found itself scrambling to figure out how a group dubbed the Shadow Brokers obtained the agency’s alleged hacking tools, some of which they posted online and others they offered to the highest bidder.The startling breach not only revealed that the NSA seemed to rely on previously unknown security vulnerabilities – called zero-days – in Cisco and Fortinet commercial software to carry out digital espionage campaigns, it also exposed N