Overview
Direct Answer
A zero-day vulnerability is a software security flaw unknown to the vendor and the public, which attackers can exploit before the organisation has released or deployed a patch. The term derives from the vendor having zero days to prepare a defensive response.
How It Works
An attacker discovers and weaponises a previously unknown code defect before the software developer becomes aware of it. This timeline advantage allows malicious actors to conduct attacks against unprotected systems whilst defenders lack both awareness and remediation options. The vulnerability remains exploitable until the vendor identifies the flaw, develops a patch, and users apply it.
Why It Matters
These vulnerabilities pose exceptional risk because organisations cannot rely on patching to mitigate harm during the disclosure lag. Financial institutions, critical infrastructure operators, and government agencies prioritise zero-day detection and response due to the potential for undetected breaches, system compromise, and regulatory violations. The absence of preventative patches elevates incident response costs and operational disruption significantly.
Common Applications
Zero-day exploits have targeted web browsers, operating system kernels, and enterprise software. Financial trading platforms and government networks face particular targeting. Vulnerability brokers and security research firms specialise in identification and disclosure of such flaws before weaponisation occurs.
Key Considerations
Detection and attribution prove difficult since attack signatures do not yet exist. Organisations must balance risk acceptance with investment in behaviour-based detection, threat intelligence, and network segmentation to limit blast radius when exploitation occurs.
More in Cybersecurity
Cyber Kill Chain
Offensive SecurityA model describing the stages of a cyberattack from reconnaissance through data exfiltration.
Security Information and Event Management
Offensive SecurityTechnology that aggregates and analyses security data from across an organisation to detect threats.
Identity Threat Detection and Response
Identity & AccessSecurity solutions focused on detecting and responding to identity-based attacks such as credential theft, privilege escalation, and compromised service accounts.
Threat Hunting
Defensive SecurityThe proactive search for cyber threats within an organisation's environment that have evaded automated detection, using hypotheses, threat intelligence, and advanced analytics.
Man-in-the-Middle Attack
Offensive SecurityAn attack where the attacker secretly relays and potentially alters communication between two parties.
Threat Modelling
Security GovernanceA structured approach for identifying, quantifying, and addressing security threats to a system or application.
SOC 2
Security GovernanceAn auditing framework that evaluates the security, availability, processing integrity, confidentiality, and privacy of service organisations.
Security Operations Centre
Defensive SecurityA centralised facility where security professionals monitor, detect, analyse, and respond to cybersecurity incidents.