When a vendor says its tool finds zero days, ask what it means by the term, how a finding is confirmed, who is told and when, and whether you can see an example. A genuine capability has clear answers. A vague one tends to rebrand ordinary known-vulnerability matching.
Three meanings of the word
People use "zero day" to mean different things, so pin it down:
- A flaw with no public fix or advisory yet, discovered by the vendor's research or analysis.
- A flaw being exploited before a fix exists, which usually comes from threat intelligence.
- A newly published advisory, which is just fast matching, not discovery.
All three can be useful. Only the first is discovery. You should know which one you are buying.
Questions about the finding
- How does the tool find these: static analysis, fuzzing, model-assisted review, behaviour monitoring?
- What is the confirmation step? An unverified suspicion is a lead, not a finding.
- How are false positives handled, and who triages before you see them?
- Can you share a sanitised example, with what a finding contains?
- Which ecosystems and package types does it cover?
Questions about disclosure
This is where responsible practice shows.
- Are maintainers notified before details go public?
- Is there a stated disclosure timeline?
- Do customers receive findings before or after maintainers, and why?
- How are identifiers requested and tracked?
A vendor that cannot describe disclosure practice is a risk for you, because you may be handed unpatched details with no coordination.
Questions about what you get
- Is the result an alert, a risk score, a remediation suggestion or all three?
- Does it say whether your code actually reaches the affected function?
- How quickly do you hear after your inventory is matched?
- What can you do in the gap before a fix exists: a mitigation, a policy block, a version pin?
What to measure in a trial
You will not see many true zero days in a 30 day trial. Instead, measure the process: time from announcement to alert for fresh advisories, quality of the context given, and clarity of the first recommended action. Ask for references from customers who received an actual early finding.
Keep expectations sensible
No tool finds every flaw in code it does not understand. Treat discovery as an additional signal on top of known-vulnerability scanning, not as a replacement.
Where Safeguard fits: zero-day discovery is a generally available part of the platform, and the free scan lets you see how findings are presented on a public repository.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at what information accompanies an early finding and what action it suggests.
Quick check
Is a fast CVE alert the same as zero-day discovery?
No. A fast alert reports a flaw others have already published. Discovery finds a flaw before it is public.
Last reviewed: 19 October 2026.
