It's a company that buys zero day and even publishes how much they are willing to pay for them on their website (software security exploits that have not been released yet)