The extent to which cyberwar may occur can be seen by the number of active hackers and hacker organizations commercial security firms track. One such firm (TruSecure) has people on line keeping track of 11,000 hackers belonging to 900 groups (most of these are informal, and hackers often operate on their own.) The primary means of attacking the Internet are by exploiting flaws in software the runs, or is used on, the Internet. Currently there are an estimated 5,000 vulnerabilities. Many vulnerabilities are not practical (too difficult or do too little damage) to exploit. Even so, only about a hundred vulnerabilities are regularly used, and only about a dozen or so have been used to launch serious attacks (the kind that make it into the general media). A military cyberwar operation could afford to exploit more vulnerabilities, on a large scale, and do significant damage. Law enforcement organizations often rely on companies like TruSecure to dig out evidence for criminal investigations of Internet crime. In theory, a government organization could do what outfits like TruSecure do. But it is difficult for a government agency to match the pay offered by commercial firms for this kind of work. Special software (to process hundreds of gigabytes of chat room and file transfer data per day) is needed to dig out useful information. But the CIA or, more likely, the NSA, could use their black (secret) budget to recruit and pay the people with the needed skills. China could also do this, as could a few other nations with a large enough budget, and native population of skilled Internet operators. In cyberwar, as in any other kind of war, good intelligence is a prerequisite for victory in battle. It should be noted that companies like TruSecure develop their information in the shadows, with no easy way to verify their press releases. Companies like this have been caught using invention, rather than innovation, to develop their view of trends in computer security. Nations that prepare for cyberwar often find that the situation is far more murky.