Overview
Direct Answer
A zero-day vulnerability is a software security flaw unknown to the vendor and the public, which attackers can exploit before the organisation has released or deployed a patch. The term derives from the vendor having zero days to prepare a defensive response.
How It Works
An attacker discovers and weaponises a previously unknown code defect before the software developer becomes aware of it. This timeline advantage allows malicious actors to conduct attacks against unprotected systems whilst defenders lack both awareness and remediation options. The vulnerability remains exploitable until the vendor identifies the flaw, develops a patch, and users apply it.
Why It Matters
These vulnerabilities pose exceptional risk because organisations cannot rely on patching to mitigate harm during the disclosure lag. Financial institutions, critical infrastructure operators, and government agencies prioritise zero-day detection and response due to the potential for undetected breaches, system compromise, and regulatory violations. The absence of preventative patches elevates incident response costs and operational disruption significantly.
Common Applications
Zero-day exploits have targeted web browsers, operating system kernels, and enterprise software. Financial trading platforms and government networks face particular targeting. Vulnerability brokers and security research firms specialise in identification and disclosure of such flaws before weaponisation occurs.
Key Considerations
Detection and attribution prove difficult since attack signatures do not yet exist. Organisations must balance risk acceptance with investment in behaviour-based detection, threat intelligence, and network segmentation to limit blast radius when exploitation occurs.
More in Cybersecurity
Cross-Site Scripting
Offensive SecurityA web security vulnerability allowing attackers to inject malicious scripts into web pages viewed by other users.
Firewall
Network SecurityA network security device that monitors and filters incoming and outgoing network traffic based on security rules.
Security Orchestration, Automation and Response
Defensive SecurityA technology stack that integrates security tools and automates incident response workflows, enabling faster triage, investigation, and remediation of security alerts.
SQL Injection
Offensive SecurityA code injection technique that exploits vulnerabilities in database-driven applications through malicious SQL statements.
Phishing-Resistant Authentication
Identity & AccessAuthentication methods such as FIDO2 passkeys and hardware security keys that are immune to phishing attacks because credentials are cryptographically bound to the legitimate service.
Information Security
Security GovernanceThe practice of protecting information by mitigating information risks including unauthorised access, use, and disruption.
Security Orchestration Automation and Response
Defensive SecurityTechnology that automates security operations by orchestrating tools and processes for incident response.
ISO 27001
Security GovernanceAn international standard for information security management systems specifying requirements for establishing and maintaining security.