What is a zero-day vulnerability?
A zero-day vulnerability is a security flaw in software, hardware, or firmware that's unknown to the vendor or anyone capable of fixing it. No patch exists. The name captures the situation precisely: developers have had zero days to address the flaw before it can be exploited. Because there's no official fix and traditional signature-based defenses have nothing to match against, a zero-day leaves every user of the affected system exposed during the gap between first exploitation and patch release. Security professionals call this the window of vulnerability. Zero-day vulnerabilities are among the most dangerous threats in cybersecurity, prized by cybercriminals, nation-state actors, and advanced persistent threat (APT) groups precisely because defenders can't prepare for a weakness no one knows about yet.
Key takeaways
- Zero days to fix. A zero-day is a flaw the vendor doesn't know about, so no patch exists and defenders start from behind.
- Three related terms, one lifecycle. The vulnerability is the flaw, the exploit is the code that abuses it, and the attack is the act of using that exploit against a real target.
- The window of vulnerability is the danger zone. The period between first exploitation and patch deployment is when systems are most exposed, with no official defense.
- Signatures can't catch them. By definition there's no known signature, so behavioral and anomaly detection are the realistic ways to catch zero-day activity.
- Post-exploitation is predictable even when the exploit isn't. Novel exploits usually lead to familiar next steps: credential theft, lateral movement, privilege escalation. That's what behavioral detection targets.
Zero-day vulnerability vs exploit vs attack
These three terms get used interchangeably, but the distinction matters because each calls for a different response. A zero-day vulnerability is the latent flaw itself, a weakness in code, design, or configuration that no one responsible for fixing it yet knows about. A zero-day exploit is the method or piece of code an attacker builds to take advantage of that flaw. A zero-day attack is the actual malicious activity carried out with the exploit to compromise systems, steal data, or cause damage.
The vulnerability is the unlocked door, the exploit is the technique for slipping through it, and the attack is the break-in. A flaw stops being a zero-day once the vendor becomes aware and issues a fix. At that point it becomes a known, patchable vulnerability, typically assigned a CVE identifier.
Why zero-days are so dangerous
Several properties combine to make zero-days uniquely threatening. There's no patch, so standard patch management offers no protection during the exposure window. They're invisible to signature-based tools such as traditional antivirus and many intrusion detection rules, because there's no known indicator to match.
Zero-days can target almost any entry point, from web browsers and email clients to operating systems, network protocols, and third-party or open-source components. And they're valuable. Working zero-days are traded on dark web marketplaces and stockpiled by well-resourced actors for targeted operations, which is why APT groups and nation-states invest heavily in acquiring them.
The stakes have grown with the attack surface. Security researchers link the sharp rise in reported zero-days to the sheer growth of software, cloud services, and internet-connected devices, though better detection also means more of them are now being caught. A then-record number of zero-day exploits were reported in 2021, more than double the prior year, and detections have remained high since.
The zero-day vulnerability lifecycle
Zero-days follow a recognizable lifecycle, and understanding where each stage sits clarifies where defense is actually possible.
- Flaw creation. A developer unintentionally introduces a bug or weakness during development, often a coding error or design oversight.
- Discovery. Someone finds the flaw before the vendor does, whether that's a threat actor, a broker, or an independent researcher, sometimes through reverse engineering.
- Exploit development. An attacker writes code to weaponize the flaw for unauthorized access or code execution.
- Exploitation in the wild. The exploit is deployed in targeted attacks or sold on cybercrime markets. This is when the window of vulnerability opens.
- Detection and disclosure. Defenders or researchers detect the activity, and the vulnerability is disclosed to the vendor, ideally through responsible disclosure. A CVE is typically assigned.
- Patch and remediation. The vendor develops, tests, and releases a patch. Organizations must deploy it quickly, since public disclosure often triggers a wave of copycat exploitation of the now-known flaw.
How zero-day attacks happen
Once an exploit exists, attackers deliver it through familiar vectors. Malicious documents or links in phishing and spear-phishing emails trigger a browser or application flaw when opened. Compromised or malicious websites launch drive-by exploitation against visitors. Specially crafted inputs abuse flaws in servers, APIs, or network-facing services, as seen in high-profile web-framework vulnerabilities. Increasingly, zero-days in widely used open-source or third-party components enable supply chain attacks that reach many organizations at once.
What makes these attacks especially hard to stop is that the initial exploit is novel, so there's no prior indicator to alert on until the intrusion is already underway.
Notable zero-day examples
The zero-day market: Who buys and sells them
Zero-days aren't only a technical problem; they're an economy. A working exploit for a widely used product can command significant sums, and several markets compete for them. On the legitimate side, vendor bug-bounty programs and specialized brokers pay researchers to report flaws so they can be fixed. In a gray zone, some brokers acquire exploits and resell them to government agencies for surveillance or offensive operations. On the criminal side, exploits and exploit kits are traded on dark web marketplaces, sometimes bundled and sold as a service.
This economy shapes attacker behavior. Because a zero-day loses value the moment it's patched, sophisticated actors often reserve their best exploits for high-value, targeted operations rather than mass campaigns. Less valuable or already-disclosed flaws get weaponized quickly and broadly. For defenders, the practical implication is that the most dangerous zero-days may be used quietly against specific targets, which is another reason detection can't rely on waiting for public indicators.
How to detect and defend against zero-days
You can't patch what no one knows about, so zero-day defense is about reducing exposure, detecting exploitation behavior, and responding fast. A layered strategy works best.
Behavioral and anomaly detection
Since there's no signature to match, the realistic path is to detect what the attacker does rather than the specific exploit. Behavioral detection, anomaly detection, and user and entity behavior analytics flag the unusual activity that follows exploitation: unexpected process execution, suspicious outbound connections, abnormal privilege changes. Sandboxing can detonate suspicious files in isolation to observe malicious behavior before it reaches production.
Reduce and contain the attack surface
Network segmentation and least privilege limit how far an attacker can move once a zero-day gives them a foothold, turning a potential breach into a contained incident. Web application firewalls and virtual patching can block known exploitation patterns at the network edge even before a vendor patch is available.
Rapid patch and vulnerability management
Once a zero-day is disclosed and a patch ships, speed is everything. Public disclosure triggers widespread exploitation of the now-known flaw. Mature vulnerability management, with prioritization of internet-facing and business-critical systems, closes the window as fast as possible.
Threat intelligence
Cyber threat intelligence provides early warning. Tracking which vulnerabilities are being exploited in the wild, which actors favor them, and what indicators to hunt for lets defenders act before an exploit reaches them, or immediately after disclosure.
People and process
Because phishing is a common delivery vector, user awareness reduces the chance a zero-day is ever triggered in the first place. A tested incident response plan and reliable backups ensure the organization can contain and recover quickly when prevention fails.
Expert insight: You can't signature the unknown, so detect the behavior
During the window of vulnerability, there's nothing to patch and no signature to block by definition. Prevention has run out of road. What remains is detection and response, and it's a fight defenders can win. However novel the initial exploit, what an attacker does next is remarkably consistent: establish persistence, steal credentials, escalate privileges, move laterally, reach for data. Those behaviors are detectable even when the entry technique is brand new, which is why behavioral detection catches attacks that signature-based tools miss entirely.
The Sekoia SOC platform is built around that behavioral, intelligence-led posture. It correlates telemetry from more than 300 integrations across endpoint, network, identity, and cloud, so post-exploitation behavior stands out even when the exploit itself is unknown. Sekoia Defend applies roughly 1,000 detection rules mapped to MITRE ATT&CK, targeting the credential-access, privilege-escalation, and lateral-movement techniques that follow a zero-day rather than relying on a signature for the exploit. Native Sekoia Intelligence and an in-house Threat Detection & Research (TDR) team track vulnerabilities exploited in the wild in near real time. Sekoia has published FLINT flash-intelligence reports on active zero-days, including a Microsoft zero-day, so the moment a flaw is disclosed, detection content and retro-hunting for related indicators follow fast. For European organizations, this comes with a data-sovereignty posture US generalists rarely match. Automated incident response means suspected zero-day exploitation can be contained in minutes.
Keep patching fast, but assume prevention will sometimes fail. Put behavioral, CTI-driven detection behind it, because against the unknown, that's the layer that actually holds.
Frequently asked questions
What is a zero-day vulnerability?
A zero-day vulnerability is a security flaw in software, hardware, or firmware that's unknown to the vendor, meaning no patch exists. The name reflects that developers have had zero days to fix it before it can be exploited. Until a patch is released, affected systems are exposed with no official defense.
What is the difference between a zero-day vulnerability, exploit, and attack?
The vulnerability is the underlying flaw. The exploit is the code or method an attacker builds to take advantage of it. The attack is the actual malicious activity carried out using that exploit to compromise systems or steal data. All three are called 'zero-day' because they occur before the vendor can respond.
Why is it called 'zero-day'?
The term originally referred to the number of days since a vulnerability became known to the vendor. A 'zero-day' means the vendor has had zero days to prepare a fix, because attackers discovered or began exploiting the flaw first. Once a patch exists, it's no longer a zero-day but a known vulnerability.
Why are zero-day attacks so hard to stop?
Because there's no patch and no known signature. Traditional antivirus and signature-based intrusion detection have nothing to match against, so a zero-day can bypass them entirely. Effective defense relies on behavioral and anomaly detection, attack-surface reduction, and fast response rather than prevention alone.
How can you detect a zero-day if it's unknown?
By focusing on behavior rather than the exploit. Even when the initial technique is novel, attackers follow predictable post-exploitation steps such as credential theft, privilege escalation, and lateral movement. Behavioral detection, anomaly detection, sandboxing, and threat intelligence can surface this activity when signatures can't.