A zero-day vulnerability is a software flaw that is unknown to the people responsible for fixing it — meaning attackers can exploit it from day zero, before any patch exists. Zero-day exploits are highly valued in criminal and nation-state hacking because there is no defence until the vendor discovers and patches the flaw.
Why is it called "zero-day"?
The name refers to the number of days the software vendor has had to respond. When a vulnerability is discovered by researchers and responsibly reported to the vendor, the vendor gets time to prepare and release a fix before the vulnerability becomes public. A "zero-day" vulnerability is one where no advance warning was given — the vendor has had zero days to fix it.
| Stage | Status | Attacker advantage |
|---|---|---|
| Vulnerability exists, unknown to all | 0 days | No attacker knows yet |
| Attacker discovers it first | Still 0 days to vendor | Attacker can exploit freely |
| Vendor discovers and patches | Day N | Window closes after patch |
| Users apply the patch | Day N+ | Fully protected |
The critical window is the gap between the attacker's discovery and the moment the patch is applied. In practice, large organisations can take weeks or months to apply patches across all their systems, leaving a significant window of exposure even after a fix is released.
How does a zero-day exploit work?
A vulnerability is a bug in software — a mistake in code that causes unexpected behaviour. Not all bugs are security vulnerabilities, but those that allow unintended access, code execution, or data disclosure are.
An exploit is the specific technique (usually a piece of code) that takes advantage of a vulnerability.
A zero-day exploit combines a previously unknown vulnerability with a working exploit, before the vendor can respond:
1. Attacker discovers a bug in, say, a PDF viewer
2. Attacker writes an exploit: a malicious PDF that
triggers the bug and executes attacker code
3. Attacker embeds malicious PDF in a phishing email
4. Victim opens the PDF → exploit runs → attacker gains access
5. Vendor eventually discovers the bug (maybe weeks later)
6. Vendor releases patch; users must apply it
Between steps 2 and 6, every user of the vulnerable software is at risk. With no patch available, traditional signature-based antivirus software (which looks for known bad files) provides no protection.
Why are zero-day exploits so valuable?
Zero-day exploits are worth large sums — reputable security firms pay hundreds of thousands of pounds for them, and criminal or nation-state buyers pay even more.
| Buyer | Purpose | Approximate value |
|---|---|---|
| Bug bounty programme | Responsible disclosure reward | £500 – £50,000 |
| Legitimate security research firm | Resell to governments for defensive use | £50,000 – £500,000 |
| Criminal marketplace (dark web) | Ransomware deployment, espionage | Similar or higher |
| Nation-state intelligence agency | Targeted espionage, sabotage | Classified |
High-profile examples include the Stuxnet worm (discovered 2010), which used four zero-day exploits to sabotage Iranian nuclear centrifuges, and the Shadow Brokers leak (2017), which released NSA-developed zero-day exploits that were subsequently used in the WannaCry ransomware attack.
How do organisations defend against zero-day threats?
Because you cannot patch a vulnerability you do not know about, zero-day defence relies on reducing the impact of a successful exploit rather than preventing the exploit itself:
Network segmentation — dividing a network into isolated zones means that a compromised machine cannot easily reach other systems. Even if an attacker exploits a zero-day, lateral movement is harder.
Principle of least privilege — users and processes are given only the minimum permissions needed for their role. An exploit gaining the privileges of a low-privilege user causes far less damage than one gaining administrator access.
Behaviour-based threat detection — rather than looking for known malicious signatures, modern security tools monitor for unusual behaviour (a PDF viewer suddenly making network connections; a Word document spawning a command prompt). This can catch novel exploits that antivirus databases do not yet list.
Prompt patch management — while patches do not fix zero-day flaws (by definition), they do fix recently disclosed ones. Organisations that apply patches quickly minimise the window of exposure once a fix is released.
Application sandboxing — running applications in isolated environments (sandboxes) limits the damage a successful exploit can do. A browser sandboxes tabs so a malicious webpage cannot access the rest of the system.
How are zero-days responsibly disclosed?
The security community has developed norms for responsible disclosure:
- Researcher discovers a vulnerability.
- Researcher privately notifies the vendor, allowing time to produce a patch (typically 90 days, Google's Project Zero standard).
- If the vendor fixes the issue within the deadline, the researcher publishes technical details after the patch is available.
- If the vendor does not act, the researcher may publish anyway to incentivise action.
This process — coordinated vulnerability disclosure — balances the researcher's interest in credit with the public's interest in a fix being available before attackers learn about the flaw.
Frequently asked questions
What is a zero-day vulnerability in simple terms?
A zero-day vulnerability is a secret flaw in software that the company which made the software does not know about yet. Because no one at the software company knows it exists, there is no patch — so attackers who discover it can exploit it freely until the company finds out and fixes it.
What is the difference between a zero-day and a known vulnerability?
A known vulnerability has been publicly disclosed, and in most cases a patch either exists or is in preparation. Defenders can protect themselves by applying the patch or using workarounds. A zero-day is unknown to the vendor; no patch exists and defenders cannot take targeted action. Known vulnerabilities are far more common in attacks — most attackers use old, unpatched flaws because many organisations are slow to apply updates.
Can antivirus software detect zero-day exploits?
Traditional signature-based antivirus, which matches files against a database of known malicious code, cannot detect zero-day exploits because it has never seen the code before. Modern endpoint security tools use behaviour-based detection — monitoring what programs actually do rather than what they look like — which can catch zero-days by spotting unusual behaviour. However, sophisticated zero-day exploits are designed to evade even behavioural detection.
What is a bug bounty programme?
A bug bounty programme is a scheme run by a company that pays security researchers who discover and responsibly disclose vulnerabilities in the company's software. Major technology companies (Google, Microsoft, Apple, Facebook) all run bug bounty programmes, offering payouts ranging from a few hundred pounds to over a million for critical vulnerabilities. Bug bounties incentivise researchers to report flaws rather than exploit them or sell them to attackers.
Explore cybersecurity threats and defences with Professor Turing at aitutors.me — the Socratic approach means you understand the concepts, not just memorise the keywords.