What Is a Zero-Day Vulnerability and How Do Companies Respond?

The term 'zero-day' gets used a lot in cybersecurity news, usually attached to a scary story about a government hacking tool or a major software breach. But what does it actually mean, and why does it matter for organizations defending their systems?

What Zero-Day Means

A zero-day vulnerability is a security flaw in software or hardware that the vendor does not know about yet. The name comes from the number of days the vendor has had to fix it: zero. Once the vendor knows about it, the clock starts -- they have some number of days to release a patch before most defenders can protect themselves.

A zero-day exploit is the actual code or technique that takes advantage of the vulnerability. Discovering a vulnerability is one thing; being able to reliably exploit it to achieve a specific goal (run arbitrary code, steal data, escalate privileges) is a separate and often harder challenge.

How Zero-Days Are Discovered

Researchers and attackers find zero-days through several methods:

Fuzzing: Automated tools send random or malformed inputs to software and watch for crashes. A crash often indicates memory corruption that may be exploitable.

Code auditing: Manually reviewing source code (when available) or disassembled binaries to find logic errors, missing bounds checks, or incorrect assumptions.

Reverse engineering: For closed-source software, security researchers decompile binaries to understand how they work and find flaws.

Variant analysis: When a patch for a known vulnerability is released, researchers analyze the fix to find similar bugs nearby that the fix did not address.

The Zero-Day Market

Zero-day vulnerabilities are bought and sold. Governments pay researchers millions of dollars for reliable exploits targeting high-value systems like smartphones and network equipment.

Bug bounty programs run by companies like Google, Microsoft, and Apple pay researchers to disclose vulnerabilities privately so they can be patched. Bounties for critical browser and OS vulnerabilities range from tens of thousands to over a million dollars.

The alternative -- selling to brokers who supply governments or criminal groups -- pays more but removes the patch timeline. A vulnerability sold this way may be exploited for years before defenders learn it exists.

How Attackers Use Zero-Days

High-value zero-days are typically used in targeted attacks against specific organizations or individuals, not deployed broadly where defenders would notice and start reverse-engineering the exploit.

Once used publicly, the exploit is likely to be discovered, analyzed, and patched quickly. This means attackers who paid millions for an exploit have a strong incentive to use it carefully.

Nation-state attackers sometimes hold zero-days for years, using them only for the highest-priority targets. Criminal groups are more likely to use exploits broadly and accept that they will be patched.

How Organizations Defend Against Zero-Days

Since a zero-day by definition has no patch, traditional patch management does not help. Defense relies on reducing the blast radius when an unknown vulnerability is exploited:

Least privilege: Run software and users with the minimum permissions needed. An exploit in a browser running as a non-admin user can do far less damage than one running as root.

Network segmentation: Isolate critical systems so that a compromised machine cannot reach everything else on the network.

Behavior-based detection: Rather than looking for known exploit signatures, monitor for unusual behavior: a PDF reader suddenly spawning a network connection, or a word processor writing to system directories.

Application isolation: Sandboxing limits what a compromised application can access. Browsers, PDF viewers, and messaging apps benefit significantly from sandbox isolation.

Attack surface reduction: Every piece of software installed is a potential vulnerability. Removing unnecessary applications and disabling unused features reduces the number of possible entry points.

Responsible Disclosure

When security researchers find a vulnerability, responsible disclosure means notifying the vendor privately and giving them a reasonable time to release a patch before making the vulnerability public. Most organizations follow a 90-day deadline, after which the vulnerability is published regardless of whether a patch exists. This creates pressure to patch quickly while still protecting users during the fix window.