A zero-day is a flaw that defenders did not know about when it was first used. NIST's glossary defines a zero-day attack as an attack that exploits a previously unknown hardware, firmware or software vulnerability. The name reflects that defenders had zero days to prepare a fix.
Three words that get mixed up
People use "zero-day" loosely, so separate the pieces:
- the vulnerability is the flaw itself
- the exploit is the code or method that takes advantage of it
- the attack is the use of that exploit against a target
NIST's definition is about the attack. In everyday speech, people also call the unpatched flaw a zero-day. Both uses are common, so check which one a writer means.
Zero-day versus n-day
Once a flaw is public and a fix exists, it is an n-day: known, patchable, and often still exploited against systems that have not updated. Most real-world compromise comes from known flaws left unpatched, not from the unknown ones. That is why a list of confirmed exploitation such as the KEV catalog is so useful for prioritizing.
Why a patch takes time
After a flaw is discovered, someone must understand it, write a fix, test that the fix works without breaking other things, and ship it. Customers then need to apply it. The gap between first exploitation and your own patched systems is the window you manage.
What you can do during the window
- Know what you run. You cannot assess exposure without an inventory, which is where an SBOM helps.
- Reduce exposure: disable the affected feature, restrict network access, or put a filter in front of it if the vendor suggests one.
- Watch for vendor advisories and apply fixes as soon as they are tested.
- Add monitoring for the affected component so unusual behavior gets noticed.
- Record what you did and when, so you can revisit the decision.
Early discovery
Some flaws can be found before attackers use them, by analyzing code and dependencies for dangerous patterns. That does not remove the zero-day problem, but it shortens the window.
Click through it at your own pace, or open it full screen.
Safeguard includes zero-day discovery and reachability analysis. A free scan is at gold.safeguard.sh/scan.
Quick check
Does a zero-day always have a CVE?
No. It may be exploited before any identifier is assigned. An identifier usually follows disclosure.
Is every exploited flaw a zero-day?
No. Many exploited flaws are known and patched, and attackers target systems that have not updated.
Sources
Last reviewed: 19 October 2026.
