What is a zero-day vulnerability?

A zero-day is a vulnerability that attackers know about and use before the vendor has released a fix, so defenders have had zero days to patch it. Zero-days are valuable and are mostly used in targeted attacks, though some later spread widely. Because there is no patch and often no signature yet, tools that only look for known bad things cannot see the exploit itself. What helps is what happens next: the compromised machine starts behaving differently, connecting to new places, scanning or moving data. Behaviour-based detection on the network aims at that stage, and good backups and segmentation limit the damage.

← All 69 questions on What is…? Network and security termsAll topics