# What is a zero-day, and can anything detect it?

A zero-day is a vulnerability that attackers exploit before the vendor has released a fix, so patching cannot help yet and no signatures exist. Zero-days are expensive and often used against internet-facing systems such as VPN gateways, firewalls and file-transfer servers. Detection therefore relies on what happens after the exploit: an appliance that suddenly talks to new outside servers, a web server that starts scanning the internal network, new administrator sessions, data leaving. Reduce exposure by keeping as few services as possible reachable from the internet, putting management interfaces behind a VPN, and following vendor advisories and CISA's Known Exploited Vulnerabilities catalogue, so that you patch the moment a fix appears. NetSenX does not detect the exploit itself; it flags the behaviour that follows, such as beaconing, scanning and unusual outbound volume, on every plan.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-a-zero-day-and-can-it-be-detected

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is the difference between brute force and password spraying?](https://netsenx.com/en/faq/difference-between-brute-force-and-password-spraying)
- [What is credential stuffing?](https://netsenx.com/en/faq/what-is-credential-stuffing)
- [What is Kerberoasting?](https://netsenx.com/en/faq/what-is-kerberoasting)
- [What is pass-the-hash?](https://netsenx.com/en/faq/what-is-pass-the-hash)
- [What is a drive-by download?](https://netsenx.com/en/faq/what-is-a-drive-by-download)