Planning a funded, full-time mobile first vulnerability research lab. What would make this work? Where do these efforts usually die?

r/ExploitDev feels like the right place to post this. I run a small, niche cybersecurity consulting company - and I'm at the planning stage of building a dedicated, full-time vulnerability research lab. I want honest feedback from people who actually do the work before I commit further. The idea: build a small, deep team, funded for the long haul,...