Bad guys don't report vulns, they use them.