An Original Theoretical Investigation of Zero-Day Vulnerability Markets and Their Implications for Nigerian Cybersecurity Policy

Zero-day vulnerability markets, encompassing both licit and illicit trade in previously unknown software vulnerabilities, create significant cybersecurity externalities that affect all countries, including Nigeria, yet the policy implications of these markets for developing economies with limited offensive cybersecurity capacity have not been theoretically examined. This study conducted an original theoretical investigation into zero-day vulnerability market structures and their implications for Nigerian cybersecurity policy. A political economy theoretical methodology was employed: systematic review of zero-day market literature (48 publications from 2018 to 2024), theoretical analysis of Nigeria's position in the global vulnerability market as a consumer, victim, and potential participant, and expert consultation with 18 government cybersecurity officials, academics, and private sector security researchers across six geopolitical zones. The theoretical analysis confirmed that Nigeria currently functions as a net victim of zero-day exploitation, with limited capacity to participate in defensive vulnerability research programmes. The original Zero-Day Policy Implications Framework for Nigeria proposes four policy dimensions: vulnerability disclosure infrastructure development (national CERT capabilities for coordinating domestic vulnerability reports), defensive research investment (funding academic and industry vulnerability research for Nigerian software ecosystems), international coordination (engagement with multilateral vulnerability disclosure norms), and legal framework modernisation (adapting Nigerian cybercrime law to protect good-faith security researchers). An original theoretical contribution is the Vulnerability Power Asymmetry Model, describing how zero-day market dynamics disadvantage under-resourced countries. Expert review confirmed the framework's original policy theory contribution.

Keywords: zero-day vulnerabilities, vulnerability market, Nigeria, cybersecurity policy, responsible disclosure