You defend against unknown threats by assuming some will get through. Reduce what an attacker can reach, watch for behavior instead of signatures, patch known exploited flaws quickly, and rehearse recovery. No tool blocks what nobody has seen yet, so the design has to tolerate surprise.
What counts as unknown?
Three things are often lumped together. A zero-day is a flaw exploited before a fix exists. A novel malware sample is new code using old methods. A new technique is an unfamiliar way to do something. Most real attacks reuse known techniques with new packaging, which is why a shared vocabulary helps. MITRE ATT&CK catalogs adversary tactics and techniques so defenders can build detection around what attackers do, not which file they used.
Where should you start?
Close known doors first. CISA's Known Exploited Vulnerabilities catalog lists flaws with evidence of exploitation in the wild. When this article was prepared, the catalog showed 1,748 entries. Unknown threats arrive through the same weak points as known ones more often than not, so patching what is already being exploited removes the easy paths.
Shrink the blast radius. Least privilege, segmentation and short lived credentials mean a breach in one place does not reach everything. CISA's advisory on the 2021 pipeline ransomware attack recommends network segmentation between IT and OT, tested manual controls, and backups that are isolated and tested. Those mitigations work without knowing the specific malware.
Detect behavior. NIST SP 800-53 control SI-4 asks for monitoring to detect attacks and indicators of attacks, plus unauthorized connections, and analysis of events and anomalies. Logging process starts, logins, outbound connections and privilege changes gives you something to analyze when a signature does not exist.
Prepare to recover. Immutable backups, tested restores and a practiced incident process turn a catastrophic event into an expensive one.
What about your own software?
Unknown threats in your applications often come from flaws in your dependencies and code that no one has reported. Reachability analysis helps you decide which flaws are actually callable in your code. Zero-day discovery work that examines packages for suspicious behavior can surface problems before a CVE exists. Safeguard offers both, and the demo below shows the zero-day watch view.
See the full walkthrough at /demos/zero-day-watch.
A constructed example
A company runs a document conversion service. Overnight, someone exploits a flaw in an image library that has no public advisory. The attacker gets code execution as the service account. Because the service runs in a container with no outbound internet except one internal queue, no cloud keys in its environment and read access to a single bucket, the attacker can do little. An alert fires on an unusual process starting inside the container. The team isolates it, rotates the one credential it had, and applies the patch when the vendor publishes it. The attack was unknown. The design made it small.
How do you practice for the unknown?
Run exercises that start from "something is wrong and we do not know what". Give the team a suspicious outbound connection from a server and nothing else, and see how quickly they can find the process, the account and the entry point. Practice isolating a host, revoking a credential and restoring from backup. Note what logs were missing. Each gap you find in an exercise is cheaper than the same gap found during a real incident, and the exercise builds the habit of reasoning from behavior when no signature is available.
How to check or apply this
- Patch entries in the Known Exploited Vulnerabilities catalog on a short, fixed deadline.
- Review which services have outbound internet access, cloud keys and broad file access, and cut what they do not need.
- Turn on logging for logins, process starts, privilege changes and network connections, and name an owner for alerts.
- Map your detections to ATT&CK techniques and look for gaps.
- Test restores and run a tabletop exercise this quarter.
Quick check
Can antivirus stop unknown threats?
Behavior based features can catch some, but nothing catches all. Use layers.
What is the single best step?
There is no single step. Limiting privilege and reach usually gives the largest reduction in impact across all kinds of threats.
Sources
- MITRE ATT&CK
- CISA, Known Exploited Vulnerabilities Catalog
- CISA, AA21-131A, DarkSide Ransomware: Best Practices for Preventing Business Disruption
- NIST SP 800-53 Rev. 5, SI-4 System Monitoring
Last reviewed: 18 October 2026.
