This Is How They Tell Me the World Ends: The Cyberweapons Arms Race: Summary & Key Insights

The story begins with a single and simple idea: wherever there is software, there are flaws. These flaws—known in my world as vulnerabilities—were once nuisances for programmers to patch. But to a spy agency, they became opportunities. A zero-day vulnerability is one unknown to the software maker and therefore unprotected. Whoever finds it first can slip through the cracks of systems thought to be secure. Early in my reporting, I met researchers who treated these exploits like treasures, trading them quietly in obscure online markets. It became clear that there was real money to be made—hundreds of thousands, even millions of dollars—for the right kind of hole in the right software.

The seeds of the cyberweapons trade were sown in the 1990s, often by well-meaning researchers who took pride in discovering flaws before bad actors did. But as governments realized the intelligence value of these tools, an informal underground economy developed. Zero-days became the currency of nation-states, sold and traded like rare commodities. I followed the trail from anonymous hackers in Eastern Europe to sleek offices in Washington where contractors bid secretly to supply intelligence agencies with their latest finds. What struck me most was how normal this had become—how markets meant for discovery and defense had morphed into markets for attack. As cyber threats matured, so too did the brokers and middlemen who linked governments with those willing to sell their code. This was the birth of a new kind of arms race, one fought not over oil or territory, but over control of cyberspace itself.

For much of the early 2000s, the United States sat unchallenged atop the digital hierarchy. The National Security Agency, with its sprawling campuses and unmatched budgets, built a cyber arsenal few could rival. The logic was simple: if wars were moving online, America should ensure it could strike first and strike hardest. The NSA’s mission expanded from defense to offense—it no longer merely protected U.S. networks but sought to penetrate foreign ones. The agency accumulated zero-day exploits, stockpiled malware, and constructed a library of digital weapons capable of sabotaging faraway systems.

Through my investigation, I learned how this strategy carried both power and peril. Many NSA actions were embedded in secrecy; oversight was minimal. Contractors such as those later linked to Edward Snowden operated within an opaque ecosystem where exploits were valued more for their exclusivity than for their ethical implications. This stockpiling, initially rationalized as ensuring national advantage, inadvertently created vulnerabilities for everyone. When classified exploits were stolen—most infamously in the 2016 Shadow Brokers leak—it was as if someone had broken into a nuclear weapons facility and begun giving away the bomb blueprints. Suddenly, the world had access to the same cyberweapons the U.S. had carefully built, and chaos ensued.

In retracing these events, I saw how hubris played a role. Many within the intelligence community truly believed that America could maintain control over what it designed. But digital weapons, unlike missiles, are infinitely replicable. Once released—even accidentally—they cannot be recalled. The NSA’s dominance would soon give way to a more multipolar and unpredictable cyber arena.