Blog / Security education
What is a zero-day? Vulnerabilities, exploits, and attacks explained
A zero-day is a flaw attackers exploit before a patch exists. Learn the zero-day lifecycle, why the risk is rising, and how to reduce exposure and detect it.
A zero-day is a software or hardware flaw that attackers exploit before the vendor has a fix, which means defenders have had zero days to patch it. It is one of the most feared terms in security for a simple reason: during the window a zero-day is in use, the standard advice to "apply the update" does not exist yet, because there is no update. This guide explains what a zero-day actually is, how the term is used and misused, the four stages of the zero-day lifecycle, why the risk is rising in 2026, and the practical steps that reduce your exposure even when no patch is available. Along the way we will separate three ideas people tend to blur together, the zero-day vulnerability, the zero-day exploit, and the zero-day attack, and show where the related term n-day fits.
What is a zero-day?
A zero-day is a vulnerability that the people responsible for fixing it do not yet know about, or have not yet fixed, at the moment it is being used against real targets. NIST's glossary defines a zero day attack as "an attack that exploits a previously unknown hardware, firmware, or software vulnerability." Google's Threat Intelligence Group uses a sharper, operational version: a zero-day is a vulnerability "maliciously exploited in the wild before a patch was made publicly available."
The name is literal. The widely cited explanation is that the vendor has had "zero days" to build and ship a fix, because the flaw became known through its exploitation rather than through a quiet report. The security field borrowed the phrase from the 1990s warez scene, as Wordfence traces it, and repurposed it to mean the number of days the vendor has had to respond: zero.
What makes a zero-day dangerous is not that it is technically worse than other flaws. Many are ordinary bugs. It is dangerous because of timing. For every other vulnerability, defenders are in principle racing a known clock: the flaw is public, a fix exists or is coming, and the job is to apply it before an attacker reaches you. A zero-day removes that option. There is no advisory to read, no patch to deploy, and frequently no detection signature, because the flaw was unknown to defenders and vendors alike.
Zero-day vulnerability, exploit, attack, and n-day
People use "zero-day" to mean three different things, and the difference matters when you are reading an advisory or a headline. A zero-day vulnerability is the flaw itself. A zero-day exploit is the code or technique that takes advantage of it. A zero-day attack is an actual intrusion that uses that exploit against a real target. A flaw can sit for years as a latent zero-day vulnerability before anyone writes a working exploit for it.
The related term n-day, sometimes written one-day, describes what a zero-day becomes after a patch exists. Once the vendor ships a fix, the vulnerability is public knowledge, but every system that has not applied the update is still exploitable. Attackers reverse-engineer patches to build exploits for these known-but-unpatched flaws, and n-day work is often easier than zero-day work, because the vendor's own advisory points to where the flaw lives.
| Term | What it is | When it applies | Who knows about it |
|---|---|---|---|
| Zero-day vulnerability | The unknown or unpatched flaw itself | Before a fix is available | Attackers and researchers, not the vendor or defenders |
| Zero-day exploit | The code or technique that abuses the flaw | Before a fix is available | Whoever built or bought it |
| Zero-day attack | A real intrusion using that exploit | Before a fix is available | The attacker, and the victim if detected |
| N-day vulnerability | A disclosed flaw with a patch available | After the fix ships | Everyone, defenders included |
The zero-day lifecycle
Every zero-day moves through the same four stages, and the whole of zero-day defense turns on one of them: the gap between the first exploit and the deployed fix, known as the zero-day window.
- It exists. The flaw ships inside real software, firmware, or hardware and sits there unknown, sometimes for years. At this stage it is a latent vulnerability, not yet a zero-day, because no one is using it and no one responsible knows it is there.
- It becomes a zero-day. Someone, a criminal crew, a nation-state team, or a broker who sells to them, discovers the flaw and begins exploiting it in the wild. There is no patch and often no detection signature. This is the danger window, when defenders are exposed and usually unaware.
- It gets patched. The vendor learns of the flaw, through a researcher, an incident, or its own testing, and ships a fix. For everyone who deploys the update, the zero-day window closes.
- It becomes an n-day. The patch is public, but exploitation does not stop. Every unpatched system is still exposed, and now the flaw is documented, which makes attacking it easier than before.
The whole story turns on that second-to-third transition. A vulnerability is only a zero-day while the window is open. Close it, by shipping and deploying a fix, and the threat changes shape into an n-day.
Why zero-days matter now
Security teams are not imagining the pressure. Google's Threat Intelligence Group tracked 75 zero-days exploited in the wild in 2024, down from 98 in 2023 but up from 63 in 2022. These counts reflect only the zero-days that were detected and disclosed, so the real total is almost certainly higher. Three shifts make today's zero-days more dangerous than the raw numbers suggest.
The time to exploit is shrinking. Mandiant found the average time from disclosure to exploitation had fallen to just five days in 2023, down from 32 days the year before, and that 70% of the vulnerabilities exploited that year (97 of 138) were first used as zero-days. The margin for a slow response has mostly disappeared.
Attackers have moved to the edge. Of the 2024 zero-days, 44% targeted enterprise products, and 20 of those were in security and networking software such as firewalls and VPN gateways. Those devices are internet-facing by design and often sit outside the reach of endpoint defenses, which is why recent zero-day campaigns against Cisco ASA and FTD VPNs, Ivanti Connect Secure, and Fortinet's FortiMail have been so damaging. CISA and international partners now publish dedicated guidance on securing network edge devices for exactly this reason.
AI is speeding the work. AI-assisted tooling is helping both sides find and understand flaws faster. FIRST's 2026 forecast expects new CVEs to climb toward 66,000 for the year, driven in part by AI-assisted vulnerability discovery. The same tooling can trim the time it takes to turn a newly found flaw into a working exploit, which narrows the zero-day window further. We cover this in depth in how attackers use AI and what AI-native security does in response.
How to defend against zero-days
You cannot patch a flaw that has no patch, but a zero-day still has to travel the same path as any other attack: it has to reach a vulnerable system, run, and then act. Every step on that path is something you can make harder. Zero-day resilience comes from stacking controls that do not depend on knowing the specific flaw in advance.
- Reduce the attack surface. The fewer systems an attacker can reach, the fewer zero-days can touch you. Decommission end-of-life edge devices, close exposed services that do not need to be public, and segment networks so a reachable asset is not also a valuable one. This is the practical half of the attack surface versus attack path distinction: shrinking what is exposed shrinks the set of flaws that can ever matter.
- Prioritize by real risk, not severity alone. When a zero-day is disclosed, the question is not how bad it could be in the abstract but whether it is reachable and exploitable in your environment. Once signals exist, the CISA Known Exploited Vulnerabilities catalog tells you what is being used in the wild, and combining it with your own exposure data is the core of sound vulnerability prioritization. The full method for weighing these signals is in our guide to CVE, CVSS, EPSS and KEV.
- Invest in detection and response. A zero-day has no signature, but an exploit still produces behavior: a process spawning a shell, a device beaconing out, a service crashing and restarting. Behavior-based detection, strong logging (including on edge devices, where forensic visibility is often weakest), and a tested incident response plan are what catch an intrusion that no patch could have prevented.
- Build defense in depth. Assume any single control can fail, including against a flaw no one knew about. Least privilege, network segmentation, and limits on what a compromised service can reach mean one successful exploit does not become a full compromise. Defense in depth is what turns a breach into an incident instead of a disaster.
- Patch fast once a fix ships. The moment a vendor releases a patch, the zero-day becomes an n-day and the clock resets in the attacker's favor as they reverse-engineer the fix. The systems hit after a patch exists were not undone by a zero-day, but by a slow patch cycle. Put edge and internet-facing systems first in line.
Done once, these steps help for a week. Done continuously, they become a program. That is the idea behind continuous threat exposure management and exposure management: keep an up-to-date picture of what is reachable and exploitable, so that when a zero-day lands you already know where you stand.
You cannot patch what has no patch, so the zero-day defense you actually control is the exposure you remove and the behavior you can see.
Where Threatless fits
Threatless is an AI-native security company, and the method in this guide, reduce exposure, prioritize by real risk, and detect the activity an exploit leaves behind, is the discipline behind Threatless CTEM. It is the connective idea across the Threatless portfolio, from Threatless Surface to Threatless DeepScan and Threatless SOC. The aim is plain to state and hard to do: keep a current, ranked picture of where you are exposed, so the day a zero-day breaks you are responding from a map rather than from scratch.
Frequently asked questions
What is the difference between a zero-day and an n-day?
A zero-day is a vulnerability being exploited before a patch is available, so defenders have no fix to apply. An n-day is the same flaw after the vendor has released a patch: it is publicly known, a fix exists, but every system that has not updated is still exposed. Most real-world breaches use n-days, because unpatched systems are common and the vendor's advisory shows attackers exactly where the flaw is.
Can antivirus or a firewall stop a zero-day?
Not reliably on their own. Traditional signature-based tools look for known threats, and a zero-day is by definition unknown, so there is no signature to match. Firewalls and endpoint tools still help by reducing exposure and by catching the behavior an exploit produces after it runs, but the durable defenses are reducing your attack surface, layering controls, and detecting suspicious activity rather than specific malware.
How are zero-day vulnerabilities discovered?
By researchers, vendors, criminal groups, nation-state teams, and brokers who buy and sell flaws. When a researcher finds one and reports it through responsible disclosure, the vendor can fix it before it is ever exploited, and it never becomes a zero-day attack. When an attacker discovers it before the vendor, or buys it from someone who did, the flaw can be used quietly for months before it is noticed. AI-assisted tools are now part of this discovery on both sides.
Are zero-day attacks common?
Serious ones are rarer than headlines suggest, but they are not rare. Google's Threat Intelligence Group counted 75 zero-days exploited in the wild in 2024, and those are only the ones that were found. For most organizations, unpatched n-day flaws and misconfigurations are a larger day-to-day risk than true zero-days, which is why exposure reduction and fast patching matter as much as zero-day-specific defenses.
The short version
A zero-day is a vulnerability attackers exploit before a fix exists, which is what makes it dangerous: there is nothing to patch during the window that matters. Keep the three ideas separate. The vulnerability is the flaw, the exploit is the code that abuses it, and the attack is the intrusion that results, while an n-day is what the whole thing becomes once a patch ships. You cannot patch your way out of a zero-day in the moment, but you can shrink your attack surface, prioritize by real risk, detect the behavior an exploit produces, and patch fast the instant a fix arrives. That is what zero-day resilience looks like in practice.