Zero-Day Exploits: Attacks Before the Fix Exists
A zero-day is a software vulnerability that the vendor does not yet know about, or has not yet fixed, which means defenders have had zero days to prepare. When attackers exploit such a flaw, there is no patch to install, which makes zero-days especially dangerous and valuable.
The term gets used loosely, so this guide clears up what a zero-day actually is, why they are so prized, and, importantly, what still protects you even when no patch exists.
Vulnerability, exploit, zero-day: the difference
A vulnerability is a flaw or weakness in software. An exploit is a technique that abuses a vulnerability to do something harmful. A zero-day is a vulnerability that is being, or can be, exploited before a fix is available.
The moment the vendor releases a patch, it stops being a zero-day, but it does not stop being dangerous, because many people are slow to patch.
Why zero-days are so valuable
Because no patch exists, a working zero-day can bypass up-to-date defenses. That rarity makes them expensive: they are traded quietly, used sparingly by well-resourced attackers, and saved for high-value targets.
Most people are not the target of a true zero-day. Far more damage is done by known vulnerabilities that simply were not patched.
How to reduce zero-day risk
You cannot patch a flaw no one knows about, so zero-day defense is about limiting damage and detecting misuse rather than prevention alone.
Reassuringly, the same layered habits that protect against everyday attacks also blunt zero-days.
- Least privilege and segmentation stop one exploited app from reaching everything.
- Behavior-based monitoring can catch an exploit by what it does, even without knowing the flaw.
- Fast patching once a fix ships closes the window before mass exploitation.
- Backups and an incident-response plan limit the impact if one gets through.
How it plays out in the real world
Based on real, widely reported incident patterns; names and details are illustrative.
The bigger risk is the patch you skipped
A vendor announced a serious flaw and shipped a patch the same day. Within a week, automated attacks were scanning the internet for systems that had not yet applied it.
The true zero-day window, before the patch existed, affected very few organizations. The mass damage came afterward, hitting everyone who delayed the update and turning a former zero-day into an easy, known target.
- Known-but-unpatched beats zero-day for real-world harm. Actual zero-days are rare and targeted. Most breaches exploit flaws that were fixed weeks or months earlier but never patched.
- The clock starts when the patch ships. Attackers reverse-engineer patches to build exploits fast. Patch critical systems quickly, ideally automatically.
- Defense in depth covers the gap. Least privilege, segmentation, and behavior monitoring protect you during the window when no patch exists yet.
Test yourself
Test your vulnerability knowledge, free.
Frequently asked questions
What does zero-day actually mean?
It refers to the number of days the vendor has had to fix the flaw: zero. It is a vulnerability being exploited before a patch is available, so defenders have had no time to prepare.
Should I worry about zero-days personally?
For most people, no. True zero-days are rare, expensive, and aimed at high-value targets. Your bigger risk is known vulnerabilities left unpatched, so keeping software updated matters far more.
How can anyone defend against a flaw with no patch?
By not relying on patching alone. Least privilege, network segmentation, and behavior-based detection limit what an exploit can do and help catch it, even when the underlying flaw is unknown.