Evaluate a zero day discovery claim by asking for reproducible examples, how findings were confirmed, how disclosure was handled, how many reports were wrong, and what scope the claim covers. A real capability can show its work. A vague one speaks in totals with no way to check them.
What the claim should mean
A zero day is a vulnerability not yet publicly known or patched. A claim that AI "finds zero days" can range from solid to hollow. Solid means the system found previously unknown bugs in real software that maintainers confirmed. Hollow means it flags suspicious patterns that are later called vulnerabilities after the fact.
Questions to ask
| Question | Why |
|---|---|
| Can you show findings confirmed by maintainers? | Confirmation is the real test |
| How were reports validated before sending? | Unverified reports burden maintainers |
| What share of reports were rejected? | Reveals false report rate |
| How is disclosure handled? | Responsible handling matters |
| In which languages and ecosystems? | Scope limits the claim |
| What did the AI do versus the human researchers? | Clarifies credit |
Be wary of totals with no identifiers. A number such as "hundreds of issues found" means little unless some can be checked.
What it means for your product choice
For a buyer, the practical question is not whether a vendor can find zero days in general, but whether the feature helps you. Does it alert you when an unknown issue affects a component you run? Does it tell you what to do while no patch exists? Ask for a worked example with a timeline, redacted if needed.
Beware of overlap with ordinary advisories
Many findings labeled as new are already in public advisories by the time you see them. Ask how the tool distinguishes truly new issues from known ones, and when you are notified.
Ask about disclosure ethics
A vendor that discovers vulnerabilities in open source should follow coordinated disclosure with maintainers. Ask for their policy and how long they wait. Maintainers are often volunteers, and unverified automated reports can overwhelm them.
Test what you can
You cannot test discovery of unknown bugs on demand, but you can test the response side: how quickly the product maps a newly published advisory to your inventory, and what it says about exposure. That part is verifiable in a trial.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how a new issue is mapped to an inventory and note what information appears and when.
Where Safeguard fits
Safeguard offers zero day discovery as a generally available capability, along with an asset inventory and a free scan at gold.safeguard.sh/scan. Ask us for worked examples and judge them the way this page suggests.
Quick check
Is a bug count enough proof?
No. Ask for confirmed, checkable examples and the rejected share.
Can I test discovery in a trial?
Not directly. Test how fast new advisories map to your inventory.
Last reviewed: 19 October 2026.
