Zero-Day Vulnerability — Technology Wiki

Overview

Direct Answer

A zero-day vulnerability is a software security flaw unknown to the vendor and the public, which attackers can exploit before the organisation has released or deployed a patch. The term derives from the vendor having zero days to prepare a defensive response.

How It Works

An attacker discovers and weaponises a previously unknown code defect before the software developer becomes aware of it. This timeline advantage allows malicious actors to conduct attacks against unprotected systems whilst defenders lack both awareness and remediation options. The vulnerability remains exploitable until the vendor identifies the flaw, develops a patch, and users apply it.

Why It Matters

These vulnerabilities pose exceptional risk because organisations cannot rely on patching to mitigate harm during the disclosure lag. Financial institutions, critical infrastructure operators, and government agencies prioritise zero-day detection and response due to the potential for undetected breaches, system compromise, and regulatory violations. The absence of preventative patches elevates incident response costs and operational disruption significantly.

Common Applications

Zero-day exploits have targeted web browsers, operating system kernels, and enterprise software. Financial trading platforms and government networks face particular targeting. Vulnerability brokers and security research firms specialise in identification and disclosure of such flaws before weaponisation occurs.

Key Considerations

Detection and attribution prove difficult since attack signatures do not yet exist. Organisations must balance risk acceptance with investment in behaviour-based detection, threat intelligence, and network segmentation to limit blast radius when exploitation occurs.

Related in Offensive Security

Cybersecurity

The practice of protecting systems, networks, and programs from digital attacks, unauthorised access, and data breaches.

Threat Intelligence

Evidence-based knowledge about existing or emerging threats to an organisation's digital assets and infrastructure.

Vulnerability Assessment

The process of identifying, quantifying, and prioritising security vulnerabilities in systems and applications.

Penetration Testing

A simulated cyberattack against a system to evaluate the security of its defences and identify exploitable vulnerabilities.

Red Team

A group of security professionals who simulate real-world attacks to test an organisation's defensive capabilities.

Blue Team

A group of security professionals who defend against both real attackers and simulated attacks from red teams.

Purple Team

A collaborative security approach combining red team attack knowledge with blue team defensive capabilities.

Intrusion Prevention System

A network security technology that examines network traffic to detect and prevent vulnerability exploits.

Ransomware

Malicious software that encrypts a victim's files and demands payment for the decryption key.

Malware

Malicious software designed to disrupt, damage, or gain unauthorised access to computer systems.

Phishing

A social engineering attack that uses fraudulent communications to trick recipients into revealing sensitive information.

Spear Phishing

A targeted phishing attack directed at specific individuals or organisations using personalised deceptive content.

More in Cybersecurity

Identity Threat Detection and Response

Identity & Access

Security solutions focused on detecting and responding to identity-based attacks such as credential theft, privilege escalation, and compromised service accounts.

Cyber Insurance

Security Governance

Insurance coverage protecting organisations against financial losses from cyberattacks, data breaches, and related incidents.

Extended Detection and Response

Offensive Security

A unified security platform that integrates multiple security tools and data sources for comprehensive threat detection.

Endpoint Detection and Response

Defensive Security

Security technology that monitors endpoint devices to detect, investigate, and respond to cyber threats.

Compliance Framework

Security Governance

A structured set of guidelines and best practices for meeting regulatory requirements and industry standards.

Threat Modelling

Security Governance

A structured approach for identifying, quantifying, and addressing security threats to a system or application.

Next-Generation Firewall

Defensive Security

An advanced firewall that goes beyond traditional packet filtering to include application awareness and intrusion prevention.

Zero Trust Architecture

Network Security

A security model that requires strict identity verification for every person and device accessing resources regardless of location.