Handling zero day vulnerabilities in house means you own the watching, matching and fixing. Buying means someone else supplies parts of that. For most teams the answer is a mix: buy the data and matching, build the decision rights and the response path, because those depend on how your business runs.
What is the job, really?
NIST defines a zero day attack as an attack that exploits a previously unknown hardware, firmware or software vulnerability. In daily work, teams use "zero day" more loosely for any serious flaw that is newly public and may be exploited before a fix exists. Either way the job has five parts: learn about it, work out if you are affected, reduce exposure now, patch when a fix lands, and prove it was done.
What does building in house involve?
Learning about it needs sources: vendor advisories, CISA's Known Exploited Vulnerabilities catalog, security mailing lists, researcher posts. Someone must read them daily, which is a real recurring cost in attention.
Working out if you are affected needs an accurate inventory of software, versions and where each runs. This is the hard part. A feed is only as useful as your ability to ask "do we run this?" in minutes. That means SBOMs for what you build, image and host inventories for what you run, and a way to search them.
Reducing exposure needs authority. Who may block a port, disable a feature or take a service offline at midnight? That is a business decision that no tool can make for you.
Patching needs pipelines and tests that let you ship a fix the same day when needed.
Proof needs records: what you checked, when, and what you changed.
What does buying cover well?
Buying fits the first two parts. Vendors can watch many feeds, normalize them and match them against your inventory. Some also analyze whether the vulnerable code is actually reachable in your application, which cuts the urgent list. Scanning products can find unknown flaws in code and dependencies before disclosure, which is a different capability from watching feeds.
What buying does not cover: your decision rights, your change windows, your customers' contract terms and your communication. Those stay yours.
How do you decide?
Score each part on three questions: how often does it happen, how bad is a slow response, and do we have the skills.
If you handle one or two serious events a year, a purchased watch and matching service plus a written playbook beats a half staffed internal team. If you ship software to many customers, the matching and reachability parts pay back faster because every event touches many products.
If you operate in a sector with strict reporting duties, keep the decision log in house even if the data is bought.
What are the hidden costs of each side?
Building: attention cost, staff turnover, stale inventory, and the risk that the one person who knows the process is on leave when it matters.
Buying: integration work, alert volume, dependence on the vendor's coverage, and data you must export and keep if you leave.
Ask any vendor how fast they add a new advisory, how they handle disputed severity, and what you can export.
Where Safeguard fits
Safeguard offers zero day discovery in agentic and scanner modes, reachability analysis to show whether a vulnerable function is called, and autonomous remediation that opens fix pull requests, off by default with categories starting on Manual. Those cover the software side of the job. Your decision rights and change process remain with you.
What to do
- Write the five parts of your zero day process and name an owner for each.
- Test your inventory with one real question: "Where do we run version X of Y?" Time the answer.
- Decide in advance who can take a service offline and under what trigger.
- Choose what to buy by which part is slowest today.
- Rehearse once a year with a past advisory.
- Keep records of each event for audits.
Quick check
What is a zero day vulnerability?
NIST defines a zero day attack as one that exploits a previously unknown hardware, firmware or software vulnerability. In practice the word is also used for new flaws exploited before a fix is available.
Should a small team build its own zero day watch?
Usually not the whole thing. Buy the watching and matching, and spend your own time on inventory, decision rights and rehearsal.
Sources
- NIST Glossary, Zero-Day Attack
- CISA Known Exploited Vulnerabilities Catalog
- NIST SP 800-150, Cyber Threat Information Sharing
Last reviewed: 18 October 2026.
