RAND study on lifetime of zero day exploits
rand.org