A zero-day is a vulnerability that is exploited or exists before a fix is available. Scanners that match known records cannot flag a flaw that has no record yet. They can only help after disclosure, so the useful question is how quickly you learn which of your systems are affected.
Definition
NIST's glossary defines a zero-day attack as an attack that exploits a previously unknown hardware, firmware or software vulnerability. People also use the word for the flaw itself, before the vendor has had time to ship a patch.
Why ordinary scanning lags
Dependency and image scanners compare what you run against advisory databases. Before an advisory exists there is nothing to match. After it is published, there is a window until your scanner's data updates, and another until you know where the package sits in your estate.
Where the time goes
| Phase | What happens | How to shorten it |
|---|---|---|
| Disclosure to advisory | Record is published | Watch more than one feed |
| Advisory to scanner data | Database updates | Use sources that refresh often |
| Data to your inventory | You find affected apps | Keep a current SBOM per application |
| Inventory to fix | Patch or workaround | Pre agree an emergency path |
What you can do before a zero-day lands
- Keep an accurate inventory of components and where each is deployed. When news breaks, you search, not guess.
- Know your exposure: which affected services face the internet.
- Practice the response. Pick a recent advisory and time how long it takes to list affected apps.
- Have a way to ship an urgent change, including a rollback.
- Reduce the damage radius with least privilege and network limits, so an unknown flaw gives an attacker less.
Common mistakes
Teams sometimes believe a scanner subscription protects them from unknown flaws. It does not, and saying so to customers creates risk. Be precise in questionnaires: you detect known issues quickly and have a response process for new ones. Also practice communication, not only patching. Decide who tells customers, what you say before you know the full impact, and how often you update. Having those answers ready is part of the response time, and it is easy to rehearse.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how a new advisory is matched against an inventory.
Quick check
Is every new CVE a zero-day?
No. Many CVEs are disclosed with a fix available. The term implies the flaw was unknown or unpatched when attackers used it.
Can fuzzing or code review find zero-days?
They can find unknown flaws in code you test. That is discovery of new bugs, a different job from matching known advisories.
Where Safeguard fits
Safeguard provides zero-day discovery, SBOM and dependency scanning and reachability analysis. The free scan shows your component list.
Sources
Last reviewed: 19 October 2026.
