When a reliable exploit is packaged into a public exploitation framework, what changes about who can attack you?

## Packaging is a distribution event When a working exploit is folded into a public exploitation framework as a module you select and fire, nothing about the vulnerability changes. The code is as broken as it was yesterday. The technique is the same technique — if you were mapping the behaviour to a published catalogue such as MITRE ATT&CK, the same identifier applies before and after, because the identifier names *what the adversary does*, not how conveniently they can do it. That is worth internalising: a technique identifier is not a measure of your exposure, and it will not move on packaging day even though your exposure does. What changes is the **population**. Model an attack as two costs: - **Capability cost** — building or acquiring something that works. Months of specialist effort, or money. - **Per-target cost** — the effort of pointing it at one more host and getting a result. A reliable exploit sitting in one person's directory has a high capability cost and a moderate per-target cost. Packaging drives both towards zero for everybody else. The module encodes the target identification, the version handling, the reliability tricks and the payload plumbing, so the skill required collapses to reading a menu, and the marginal cost of trying it against one more address collapses to bandwidth. ## Two consequences, and the second is the one candidates miss **First, the skill floor drops.** People who could not have produced this attack can now run it. The set of people who can attack you goes from "operators who could write it or pay for it" to "anyone who can install software". **Second — and this is the part that actually reshapes your risk — the target selection rule changes.** A capable operator picks targets, because their time is expensive and finite. They attack you if you are worth attacking. Once the per-target cost is near zero, nobody is picking. Attacks become indiscriminate: whole address ranges get swept and fired at, because a hit that is worth nothing still costs nothing to attempt. Organisations that were never worth a skilled adversary's attention are now attacked constantly, not because anyone decided they were interesting but because nobody decided anything at all. This is why exploitation attempts against a newly packaged flaw tend to arrive as a step change rather than a ramp, and why "we're too small to be a target" stops being true the moment a capability is commoditised. It was never a statement about your defences; it was a statement about somebody else's opportunity cost, and packaging deleted that cost. ## What packaging does not do It does not make the attack more powerful. If anything a general-purpose module is slightly *less* capable than the bespoke exploit it came from: to cover many targets it trades edge-case reliability for breadth, and it exposes fewer knobs than the person who wrote the original had. The operator who could already do this gained nothing at all — they were never waiting for the module. It also does not change the flaw's intrinsic severity. Severity describes properties of the vulnerability: what boundary it crosses, what privilege it needs, what it yields. Those are fixed at the moment the bug was written. Weaponisation state describes the world around the flaw, and it moves independently. Two flaws with identical severity can present wildly different exposure because one is commoditised and the other exists only as three paragraphs in an advisory. ## Which rung matters more depends on who holds the entry condition Reliability and packaging are not ranked in the abstract; their importance depends on who already satisfies whatever the exploit needs to start. - If the flaw is remote, unauthenticated and internet-facing, the entry condition is "has an internet connection" — the whole world already holds it. Here **packaging** is the enormous jump, because the only thing standing between you and the world was skill, and skill just became optional. - If the flaw needs an authenticated session, or code already running on the box, the population that holds the entry condition is small and comparatively capable. Packaging matters less to them, because they could mostly manage already; **reliability** is the rung that changed what that small population can achieve. ## The interview answer State the direction of the change first — capability unchanged, audience transformed — then justify it with the cost model, then name the second-order effect on target selection. Finish by saying that your own re-rating happens on packaging day even though the advisory and your estate are both untouched, because the thing you are rating is not the flaw alone but the flaw multiplied by the number of people who can use it.