The days of Metasploit 0-days are over, so now it's just loads of sensationalist reporting and box-ticking regulation in companies.