A zero day is a flaw that defenders did not know about or could not yet fix, while an n-day is a known flaw with a public fix or advisory that has been out for some number of days. Most of your exposure is usually n-days you have not patched, but zero days need a prepared response.
What is an n-day?
"N" counts the days since disclosure or patch release. A vulnerability becomes an n-day once the flaw is public and a fix, or at least an advisory, exists. The term is informal. There is no standards body definition, so use it with a note on what you mean. NIST's glossary defines a zero day attack as exploiting a previously unknown vulnerability, which is the other end of the same timeline.
How do they differ?
Knowledge. A zero day is unknown to the vendor and the public, or known but unfixed. An n-day is public.
Defenses. For a zero day, scanners and signatures usually cannot help yet. You rely on reducing exposure, limiting privilege and detecting behavior. For an n-day, a patch or workaround exists, and scanners can report it.
Attacker effort. A zero day takes research to find. An n-day exploit can often be built from a public patch or advisory by comparing what changed, which is why the days after disclosure are risky.
Volume. Zero days are rare for any one defender. N-days are everywhere in dependency trees and old servers.
Controls. Zero days test inventory, containment and detection. N-days test patch speed and prioritization.
Where do they overlap?
Every n-day was once a zero day. The same flaw changes category when it is disclosed. And between disclosure and your patch, you are exposed to it as an n-day while attackers have working knowledge. The window between "fix exists" and "fix applied" is yours to control.
CISA's Known Exploited Vulnerabilities catalog lists vulnerabilities with observed exploitation. CISA says organizations should use it as an input to prioritization. Speed on known issues matters for that reason.
Which should you prioritize?
Both, differently.
For n-days, the work is steady: keep an inventory, scan, rank and patch within set times. Rank using exploitation data and reachability, not severity alone. The CVSS user guide says Base scores should not be used alone to assess risk. EPSS estimates the probability that a CVE will be exploited in the next 30 days, and FIRST states it is not a complete risk score. CISA's SSVC model turns exploitation, technical impact and other factors into Track, Attend or Act style decisions.
For zero days, the work is preparation: a queryable inventory, containment options for common components, monitoring that watches behavior, and a rehearsed communication plan. You cannot patch what has no patch, but you can shorten time to know and time to contain.
If you must choose where to spend the next hour, spend it on n-days. Unpatched, exploited, reachable flaws are the most reliable route in, because the fix already exists. Then rehearse the zero day response.
A constructed comparison
This example is invented. Two events in one week. Event one: a maintainer announces a flaw in a widely used library, no fix yet. You query inventory, find three services, check reachability, find one reachable, apply a configuration workaround and subscribe for the fix. Time to know: under an hour. Event two: a six month old flaw in a build tool appears in the exploited catalog. Your scanner has flagged it for months at "medium". You patch within the week. The second event was the more avoidable.
How do the metrics differ?
For n-days: median time from advisory to fix, share of exploited items open past target, and age of the oldest reachable item. For zero days: time to know which assets are affected, time to contain and inventory coverage. See our companion post on metrics that matter and mislead.
NIST SP 800-40 Rev. 4 frames patching as preventive maintenance and stresses planning, which serves both cases.
Where Safeguard fits
For n-days, reachability analysis and policy gates help you rank and enforce fixes at build and release, and fix pull requests are available through autonomous remediation, off by default with categories starting on Manual. For zero days, Safeguard offers discovery in agentic and scanner modes. None of this replaces your own response drills.
What to do
- Keep a queryable software inventory.
- Rank known flaws by exploitation, reachability and context, not severity alone.
- Set patch times per tier and track exploited items past due.
- Prepare containment options for zero days, and rehearse them.
- Watch the exploited catalog for confirmation of attacks.
- Report n-day and zero day metrics separately.
Quick check
Is an n-day less dangerous than a zero day?
Not necessarily. N-days are often easier to exploit because the fix or advisory shows where the flaw is, and they are far more common in real estates.
Is n-day a formal term?
No. It is informal shorthand for a known flaw, counted in days since disclosure, so say what you mean when you use it.
Sources
- NIST glossary: zero-day attack
- CISA Known Exploited Vulnerabilities
- CVSS v4.0 User Guide
- FIRST EPSS FAQ
- CISA SSVC
- NIST SP 800-40 Rev. 4
Last reviewed: 18 October 2026.
