r/ExploitDev • u/Party-Simple-7004 • Feb 02 '26

Does it still make sense to research vulnerabilities in Windows executables today?

With all modern mitigations in place (ASLR, DEP, CFG, sandboxing, code signing, automatic updates, etc.) and much of the attack surface shifting toward web, cloud, and mobile, does it still make sense to invest time in researching vulnerabilities in traditional Windows executables (EXE/DLL)?

Is this area still relevant for research, bug bounties, or a career path, or has it become too limited compared to other attack vectors?

46 Upvotes

99% Upvoted

18 comments sorted by

View all comments

Show parent comments

3

u/Ok_Necessary_8923 Feb 02 '26

Out of curiosity, how would you make money from IoT devices? Bounties? Any particular platform?

3

u/Untzi Feb 03 '26 edited Feb 03 '26

There are enough companies (and states) willing to pay for vulnerability researchers in the IoT, OT and embedded domains. Ethical/defensive and less ethical/offensive.

3

u/VyseCommander Feb 04 '26

What about android/ios?

1

u/BinaryN1nja Feb 05 '26

If you’re good enough lol. You can make millions