Ha, true. And the hedge fund should make its trades public. "Sir, the vulnerabilties hedge fund just bought options on our stock.". "Fuck, which of our software is it?"
Then the company could contact the fund holders for information and they could tell them "we'll let you know about the vulnerability in a month or two".
