A zero-day is a software vulnerability that is exploited by attackers before the vendor has a patch available, leaving defenders zero days to fix it. The term covers three related things: a zero-day vulnerability (the unknown flaw), a zero-day exploit (the code that abuses it), and a zero-day attack (using that exploit in the wild before a fix exists). The danger is timing: there is no patch to apply and often no signature to detect, so a zero-day can succeed against fully updated systems.

Understanding what is a zero-day matters because it names the gap that patching cannot close. Most vulnerabilities are N-day flaws, meaning a fix already exists and the risk is that you have not applied it yet. A zero-day is the opposite: even a diligent team that patches everything immediately is exposed, because the vendor itself does not yet have a fix. That is why zero-days command high prices and attention, and why defense against them is about limiting damage rather than preventing the initial flaw.

What is the difference between a zero-day and an N-day vulnerability?

The distinction is whether a patch exists. A zero-day has no available fix at the time of exploitation; an N-day (sometimes called a known vulnerability) has a patch, and the exposure comes from the delay before organizations apply it. Once a vendor releases a fix, a zero-day effectively becomes an N-day, and the race shifts from the vendor building a patch to defenders deploying it.

In practice, most breaches use N-day flaws, not zero-days, because unpatched known vulnerabilities are far more plentiful. Our analysis of the vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog in 2025 found a median gap of just 26 days between a flaw being disclosed and being exploited, and that about one in five was exploited on or before the day it was disclosed, which is the zero-day tail of that distribution.

Why are zero-day attacks so dangerous?

Because the two defenses organizations rely on most, patching and signature-based detection, are both unavailable. There is no update to install and often no known indicator to alert on, so a zero-day can bypass tools that are working exactly as designed. Attackers who possess a zero-day also have a window of guaranteed novelty: until the flaw is discovered and disclosed, defenders do not know to look for it. That combination is why zero-days are prized by both state-linked actors and well-funded criminal groups.

How do you defend against zero-day attacks?

You cannot patch what has no patch, so zero-day defense is about resilience and containment rather than prevention of the flaw itself. The controls that help are the ones that limit what any single exploit can achieve: least privilege and network segmentation to contain a foothold, behavior-based detection that flags anomalous actions rather than known signatures, and a fast patching process so that the moment a zero-day becomes an N-day, you close it before attackers pivot to mass exploitation. Assuming compromise and verifying continuously beats hoping the perimeter holds.

Frequently asked questions

Is a zero-day the same as an exploit? No. The zero-day is the unknown vulnerability; the exploit is the code or method that takes advantage of it. A zero-day exploit is one written for a flaw that has no patch yet.

Are most attacks zero-days? No. The majority of real-world attacks use known, patchable N-day vulnerabilities that organizations have not yet fixed. Zero-days are rarer and more valuable.

What happens when a zero-day is disclosed? The vendor typically issues a patch, and the flaw becomes an N-day. Exploitation often rises right after disclosure, as more attackers reproduce it, so fast patching matters most in that window.

Our read

The word zero-day gets used for glamour, but the more useful framing is about time, not mystique. The dangerous window is the gap between exploitation and remediation, and that gap has a zero-day head (before any patch) and a long N-day tail (after a patch, before you apply it). Our own data shows the median disclosure-to-exploitation window is 26 days, which is why the defensible posture is continuous verification: assume something will slip the perimeter, contain what a single exploit can reach, and close the N-day gap fast so a true zero-day is the only thing you ever actually face.

Timing statistics from Nexus Void analysis of the 2025 CISA KEV catalog; exploitation data per CISA KEV and FIRST EPSS. Sources linked above.

Related: How to prioritize vulnerabilities and What is CISA KEV?.