A zero-day vulnerability is a security flaw that is exploited before the vendor knows about it or has had any time — zero days — to fix it. The name counts the vendor's patch window: while a normal vulnerability gives users an update to install, a zero-day is being used against live targets with no fix available yet. That asymmetry is why zero-days command seven-figure prices from both defense firms and brokers, why intelligence agencies hoard them, and why the discovery of one in a widely used product — browsers, operating systems, phones — triggers immediate emergency patching once a vendor ships the fix.
How does the zero-day economy work?
Zero-days are found by three overlapping populations. Security researchers hunting for reputation and bug bounties — where top programs now pay millions for the best mobile and operating-system chains. Governments: the U.S. has a formal vulnerabilities-equities process weighing disclosure against retention, and its intelligence agencies openly budget for buying and using them; other states are less documented but no less active. And the commercial gray market: brokers like Zerodium publicly list seven-figure offers for weaponized exploits of phones and messaging apps, selling to undisclosed buyers. The supply is small — Google's Project Zero tracked on the order of dozens of in-the-wild zero-days per year in its public accounting — but each one concentrates enormous leverage while it lasts.
What does zero-day exploitation look like?
The pattern repeats: a researcher or attacker finds the flaw; the attacker uses it quietly — a watering-hole page that compromises specific visitors, a malicious attachment exploiting a document parser, an internet-facing appliance bypassed remotely; eventually a vendor, defender, or researcher discovers the exploitation, and the vendor ships an emergency patch; the zero-day then becomes an n-day, and its remaining life is spent attacking everyone who delays updating. That last phase is where most victims actually fall — the population of unpatched systems dwarfs the population of zero-day targets, which is why patch speed dominates the post-disclosure timeline.
Why do we hear about so many now?
Detection got better and disclosure norms shifted. Google's Project Zero began publishing detailed analyses of in-the-wild exploits in 2019-2021; vendors got faster at attributing crashes to attacks; telemetry from browsers and operating systems surfaces anomalies that used to pass unnoticed. The counts rose accordingly — Project Zero and Microsoft's own threat-intelligence reporting tracked rising annual totals through the early 2020s — andspyware vendors using zero-days against journalists and political figures brought the subject to mainstream policy. A higher count partly means more attacks, and partly means more attacks being caught.
How do defenders handle a flaw with no patch?
While the vendor works, defenders lean on compensating measures: intrusion detection tuned to the exploit's behavior, disabling or restricting the vulnerable feature where possible, segmenting the affected system, and watching the vendors' and CISA's advisories for the patch's arrival. Once the patch ships, the calculus flips instantly — apply it immediately, because every zero-day disclosure starts a countdown in which scanning tools add the new flaw within hours and the unpatched become the target list. CISA's Known Exploited Vulnerabilities catalog formalizes this for federal agencies, and its deadlines are the sensible rule for everyone.
What can individuals do?
Less than vendors, more than nothing:
- Keep browsers and operating systems on automatic updates. The browser is the most-zero-day-targeted software most people run, and its silent update channel is the single best defense.
- Restart weekly. Chrome and Firefox apply pending updates on restart — an always-open browser runs old code indefinitely.
- Treat "update available" notices as urgent when the news names a zero-day — the gap between disclosure and full installation is exactly the window attackers retool into.
- Layer identity defenses. Zero-days compromise devices; MFA and unique passwords limit what a compromised device can reach. Endpoint compromise plus reused passwords is the full-loss scenario.
Are zero-days the main threat?
No — and the distinction keeps risk proportionate. For individuals and most organizations, unpatched known vulnerabilities, stolen credentials, and phishing cause the overwhelming majority of incidents; zero-days are the weapon of targeted operations against high-value victims. The same boring stack — updates, MFA, backups, password hygiene — defends against the mass threats and reduces what any zero-day can do to you afterward. Zero-days deserve awe and attention; they do not deserve to be your mental model of how attacks usually arrive.
For more context, read Botnets and residential proxies: how your spare router earns money for criminals.
For more context, read vishing.
For more context, read infostealer malware.