New security bug reports were often sent to CERT, sometimes in unencrypted emails. These were what RGB and I were after, new bugs that we could leverage to get into systems, almost as if we had a master key to the server. Our goal was to leverage the "window of exposure," the time lapse until the manufacturer came up with a patch and companies could get it installed. Such security holes had a limited shelf life: we would have to make use of them before they were fixed or otherwise blocked.