Zero-Day Exploit

A zero-day exploit is an attack that takes advantage of a software vulnerability that the vendor does not yet know about and has not fixed. The term captures the defender’s position: the vendor has had zero days to develop and release a patch, so when the attack occurs there is no official fix available. The related terms are a zero-day vulnerability, the unknown flaw itself, and a zero-day attack, the act of exploiting it.

Zero-days are prized by attackers precisely because defenders are unprepared. Security tools that rely on signatures of known threats cannot recognise an exploit for a flaw no one has documented, and organisations cannot patch a vulnerability they do not know exists. This gives an attacker using a genuine zero-day a significant advantage, which is why such exploits command high prices on both legitimate and criminal markets and are often reserved for high-value or state-sponsored operations.

The lifecycle of a zero-day matters for defence. There is a window, sometimes long, between a flaw being discovered by an attacker and being discovered by the vendor or security researchers. Once the flaw becomes known and a patch is released, the vulnerability is no longer a zero-day, but the risk does not end: many organisations are slow to patch, so attackers continue exploiting the now-known flaw against unpatched systems. In practice, far more damage is done by known, unpatched vulnerabilities than by true zero-days.

This has an important implication for how organisations allocate effort. True zero-days are rare and, for most organisations, largely unavoidable in advance. Known vulnerabilities that remain unpatched are common and entirely addressable. Sound programmes therefore focus the bulk of their effort on patching known, exploited vulnerabilities quickly, using signals such as the CISA Known Exploited Vulnerabilities catalogue and EPSS scores to prioritise, while accepting that defence in depth is the main protection against the occasional zero-day.

Defending against zero-days relies on controls that do not depend on knowing the specific flaw: behavioural detection that spots the actions an exploit takes rather than its signature, network and endpoint monitoring, least privilege and segmentation to limit impact, and prompt patching once a fix appears to close the window of continued exploitation. No control prevents all zero-days, but layered defences reduce both the chance of success and the damage of any single exploit.

The practical lesson of zero-days is where to focus effort. True zero-days are rare and largely unavoidable in advance, so obsessing over them is a poor use of limited resources. Known vulnerabilities that remain unpatched, by contrast, are common, entirely addressable, and responsible for far more real-world harm. Patching known, actively exploited flaws quickly, guided by signals like CISA KEV and EPSS, protects against the threats organisations actually face.

Precursor helps organisations focus remediation where it counts, prioritising the known, actively exploited vulnerabilities that cause most real-world harm, while its detection services watch for the behaviour an exploit produces rather than relying on signatures alone.