Treat zero-day detection claims as hypotheses. Ask what the tool actually analyzes, what it has found that was later confirmed, how findings are validated and disclosed, and how false positives are handled. A claim backed by specific, checkable examples is worth more than a broad promise.
Define the term
Zero-day can mean a vulnerability with no public advisory yet, a flaw being exploited before a fix, or simply a newly published issue. Vendors use the word loosely. Ask which meaning applies. A tool that notices suspicious package behavior early is doing something different from a tool that finds a previously unknown bug in a library.
What to ask
What does the tool inspect: source code, binaries, package behavior or advisories? What is the method, static analysis, behavioral signals or models? Can the vendor point to findings that were later confirmed by maintainers or assigned identifiers, with dates? What was the false positive rate and how was it measured? How are discovered flaws disclosed to maintainers? How quickly do findings reach customers?
How to test it
You cannot test for unknown bugs on demand, but you can run retrospective checks. Take a few vulnerabilities that were disclosed recently and ask how the tool would have behaved before publication, or what it reported at the time. Also test the early warning path: when a new advisory appears for something you use, how long until the tool tells you, and does it say which of your products are affected.
Keep expectations realistic
No tool finds every unknown flaw. Treat discovery as one input into prioritization, next to advisory feeds, exploit data and your own exposure. The strongest operational value is often speed of impact mapping once something is disclosed. Judge on both discovery and response, and ask for evidence rather than adjectives.
Watch for language that blurs discovery and detection. Finding a flaw in a library is research. Noticing that a package behaves badly after install is monitoring. Both are valuable, but they answer different questions and have different failure modes. Ask the vendor to say which one they mean in each example they give, and ask for the lag between first signal and notice to customers. Specifics make the claim testable.
Try it yourself
Click through the demo and watch how the results change as you move through each step.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard includes zero-day discovery alongside dependency scanning, reachability analysis and continuous monitoring.
Quick check
Can a buyer verify a zero-day claim?
Partly. Ask for dated, confirmed examples and check them against maintainer or advisory records.
Last reviewed: 19 October 2026.
