A zero day exploit is an attack that uses a software flaw the vendor does not yet know about — so there is no patch, and the software has had "zero days" to fix it. The attacker finds or buys the flaw, builds a way to exploit it, and uses it while every defender, including the company that wrote the software, is blind to it. The name describes the window, not the technique: once the flaw is known and a patch exists, it stops being a zero day.
TL;DR
- Zero day = a flaw the vendor has known about for zero days; the exploit is the code that uses it.
- There is no patch during the zero day window, so no single tool stops it — defence in depth is the answer.
- Well-known examples include Log4Shell (2021) and the 2021 Exchange Server proxylogon attacks.
- Patching speed still matters most, because most attacks exploit flaws that were fixed long ago.
- Staff reporting and MFA limit what a zero day can achieve even when it lands.
What "zero day" actually means
Every piece of software has bugs. Most are harmless. A few let an attacker do things the software was never meant to allow — run their own code, read files they should not see, or impersonate the application to users. When security researchers or attackers discover such a flaw and the vendor has not yet released a fix, the flaw is a "zero day vulnerability", and code that uses it is a "zero day exploit".
The clock starts when the flaw is first used or disclosed. "Zero day" means the vendor has had zero days of warning. Once a patch ships, the vulnerability becomes a known, patchable one — and the balance shifts: from that point, the attacker needs an unpatched machine to succeed, while the defender just needs to apply the update.
How a zero day attack actually runs
- Discovery. The attacker (or a researcher they buy from) finds a flaw through code review, fuzzing, or studying a leaked copy of the software.
- Weaponisation. They build an exploit — the exact input or request that makes the software misbehave in a useful way.
- Delivery. The exploit arrives through a phishing link, a malicious website, an infected attachment, or directly against an internet-facing server. This is where the attack often pairs with phishing: the zero day is the lockpick, the email is how it gets to your door.
- Exploitation and persistence. The flaw is used to install malware, steal credentials, or pivot deeper into the network.
- Vendor response. The vendor learns of the flaw (sometimes from the attack itself), develops and tests a patch, and publishes it. The window can last days or months.
Zero day vs known vulnerability: why the difference matters for your risk
| Zero day | Known, unpatched vulnerability | |
|---|---|---|
| Patch available | No | Yes |
| Vendor awareness | None yet | Public — often with advisories |
| Who is exposed | Everyone running the software | Everyone who has not applied the patch |
| Your defence | Layered controls, fast response | Patching discipline |
| Share of real-world attacks | A minority | The majority |
That last row is the one most people get wrong. Real-world attacks overwhelmingly use flaws that were already known and already fixed — because unpatched machines are everywhere. That is why patching cadence, not zero day paranoia, is the control that prevents the most incidents. The Essential Eight framework puts patching alongside application control and MFA for exactly this reason.
Famous zero day examples
- Log4Shell (December 2021). A flaw in Log4j, a logging library used in countless Java applications, let attackers run their own code by sending a crafted string. It was exploited within hours of disclosure and forced emergency patching worldwide.
- Microsoft Exchange proxylogon (2021). A chain of exploits against on-premises Exchange servers let attackers read email and install web shells on tens of thousands of servers before patches shipped.
- Browser and mobile zero days. Vendors like Google, Apple and Microsoft regularly patch zero days that were used in targeted attacks — Chrome and Safari publish these advisories monthly.
The pattern in every case: the exploit worked until a patch existed, and after the patch, only unpatched systems remained vulnerable.
How to defend against zero day exploits
You cannot patch a flaw nobody knows about, so the defence is layers that limit what any single exploit can do:
| Layer | Control | What it limits |
|---|---|---|
| Attack surface | Application allow-listing, removing unused software | Fewer programs an exploit can target |
| Privilege | Users run without admin rights | Exploit code lands with limited access |
| Identity | Multi-factor authentication on every account | A stolen password alone is not enough — see does MFA stop phishing |
| Patching | Update within days of release | Closes the window the moment it opens |
| Detection | Endpoint detection, logging, alert review | Catches the unusual behaviour an exploit leaves behind |
| People | Trained reporting of odd behaviour | A laptop "acting strange" gets reported instead of ignored |
Why staff reporting still matters for a technical attack
Zero days are software problems, but the response is human. The employee who notices their browser opening tabs on its own, their files renaming themselves, or their machine running hot at midnight — and reports it the same hour — can turn a month-long intrusion into a contained incident. Cyber Aware's security awareness training drills exactly that reflex alongside phishing recognition, and human risk reporting shows whether the habit is sticking across the team.
FAQ
What is a zero day exploit? An attack that uses a software vulnerability the vendor has not yet discovered or patched — the vendor has had "zero days" to fix it. The exploit is the code that takes advantage of the flaw.
What is the difference between a zero day vulnerability and a zero day exploit? The vulnerability is the flaw in the software; the exploit is the code or technique that uses the flaw to attack. One is the unlocked window, the other is the burglar's arm reaching through it.
Do antivirus and firewalls stop zero days? Sometimes, but never reliably — the attack is new by definition, so signature-based tools have nothing to match. Behaviour-based endpoint detection, application allow-listing and privilege limits are the controls that catch or contain what signatures miss.
How long does a zero day window last? Anywhere from days to years. Well-resourced vendors patch discovered flaws within days; flaws that are never disclosed can be exploited for years until they surface in an attack or a leak.
Are zero days common in small business attacks? Rarely. Attackers use cheap, known methods against small businesses — phishing, stolen passwords, unpatched systems — because they work. Zero days are expensive and usually saved for targets worth the cost. Your realistic defence is patching, MFA and trained staff, not zero day hunting.
What should we do when a zero day hits software we use? Follow the vendor's advisories, apply the patch as soon as it ships (prioritising internet-facing systems), check logs for signs of exploitation before the patch date, and report anything unusual immediately.
One last thing
Check patch latency on your most-exposed systems: how many days pass between a vendor's patch release and your team applying it? For most small businesses that single number predicts security outcomes better than any zero day worry — and if nobody owns the answer, that is a gap assessment conversation worth having.