What is a zero-day?

Zero-days in plain English

The term describes the time defenders have left: zero days. Normally, things go like this: a vulnerability is discovered, the vendor develops an update – also called a patch – and users install it. With a zero-day, this sequence is broken. Attackers already know about the flaw and are exploiting it while the vendor is still unaware of it or is still working on a fix.

An analogy: a door lock has a design flaw that allows it to be opened with a simple trick. The manufacturer knows nothing about it, so there’s no fix for it either. Only a burglar knows the trick. As long as he keeps it to himself, even the most careful locking up won’t help.

Strictly speaking, there’s a difference between the zero-day vulnerability – the flaw itself – and the zero-day exploit, the program that takes advantage of it (see exploit).

How a zero-day attack works

1. Discovery: Someone finds a previously unknown vulnerability – criminals, government agencies, or security researchers.
2. Exploitation: Anyone planning an attack develops an exploit. Such exploits are very valuable; they are used for targeted attacks or traded for high prices.
3. Disclosure: At some point, the attacks are noticed, or the flaw is reported to the vendor. As a rule, it then receives a globally unique identifier, known as a CVE number.
4. Update: The vendor releases a patch. From this point on, the flaw is no longer a zero-day. However, it remains dangerous for anyone who doesn’t install the update promptly – experts then refer to it as an “n-day” vulnerability.

Reputable security researchers report the flaws they find to the vendor confidentially. This allows the vendor to provide an update before details become public (coordinated vulnerability disclosure).

A practical example

An engineering firm operates a portal through which clients exchange large design files. Criminals discover a previously unknown flaw in the portal software and exploit it before the vendor knows about it.

However, the firm was prepared: the portal sits in an isolated network zone (DMZ), runs with minimal privileges, and has no direct access to the internal servers. Monitoring detects unusually large outbound data transfers and raises the alarm. The IT team takes the portal offline and preserves the evidence for a forensic analysis.

A few days later, the vendor releases an update. The firm installs it immediately. The damage remains limited to the portal.

Why does this matter for businesses?

No update can protect against a zero-day, because none exists yet. Yet many security strategies rely on precisely those updates. Flaws in systems that are directly reachable from the internet are particularly sought after – such as VPN gateways, firewalls, mail servers, or file-sharing portals. Once such flaws become known, attackers often exploit them on a massive scale.

The topic is also relevant from a regulatory perspective: since September 11, 2026, the Cyber Resilience Act has required manufacturers of products with digital elements – that is, connected devices and software – to report actively exploited vulnerabilities in their products. For users, the rule is: the faster you respond once a flaw becomes known, the smaller the window of opportunity for attackers.

How to protect your organization

• Shrink your attack surface: Make only what is truly necessary reachable from the internet, and disable anything superfluous (system hardening).
• Segment your network: Divide it into separate zones so that a compromised system can’t become a stepping stone for further attacks.
• Limit privileges: Give services and accounts only the privileges they need for their task.
• Monitor behavior: Use attack detection that recognizes suspicious behavior, not just known patterns – for example with EDR/XDR, software that continuously monitors computers and servers for suspicious activity.
• Patch quickly: As soon as an update is released, install it – internet-facing and critical systems first.
• Prepare for emergencies: Have an emergency plan ready, along with tested backups that are disconnected from the network.

How Rootsektor can help

No test can predict an unknown zero-day in third-party off-the-shelf software. However, a penetration test shows how far an attacker would get after a successful breach and whether segmentation, privilege management, and detection limit the damage – learn more on our Penetration Testing page. In software you develop in-house, a test or code review can also uncover previously unknown vulnerabilities. If you suspect that a flaw has already been exploited in your environment, a Compromise Assessment determines whether attackers have left traces in your systems. In an acute incident, you can reach us at +49 2932 465265-0 – outside business hours via our 24/7 emergency hotline at the same number.