Good money can buy a good chunk of 0-day exploits from black hats.

I wonder how many companies rely on in-house exploit research and what would be the turnaround related to buying from 3rd parties.