Also, a lot of companies/orgs deny vulnerabilities exist or even “shoot the messenger.” Reporting is often an inconsistent, chaotic gamble, which pushes more people to either not report the issue, give up or go black hat to monetize their findings.