What is a Zero-Day Vulnerability?

A zero-day is a security flaw that the people responsible for fixing it do not know about yet. Whoever found it first can walk in unopposed, because there is no patch to install and no warning to act on. The name is the countdown: the vendor has had zero days to fix it.

A zero-day is defined by who knows about the flaw, not by how severe it is: an ordinary flaw gets reported to the vendor, patched and announced, so defenders can install the fix while attackers race to reach whoever has not. With a zero-day the vendor and every defender are still unaware, while whoever discovered it knows exactly where to push. There is no patch to install, and nothing for security tools to match against, because those tools work from the patterns of known attacks. What one is worth follows directly from that, because even an organisation that installs every update the day it appears has no update to install against this one. Brokers pay well into six and seven figures for a zero-day in widely used software, and the buyers include governments as well as criminals. The countdown in the name starts the day the vendor finally learns the flaw exists, often because an attack using it was detected, and from that day it is patch-writing against exploiting until the window shuts. One thing worth keeping in perspective: zero-days get the headlines, but most breaches are not zero-days at all, and involve a flaw that was made public and fixed months earlier by an owner who never installed the update.

A flaw in a lock that only the burglar knows about. The key still turns, the door still looks solid, and nothing about the house suggests anything is wrong, while one specific trick opens it in seconds. You cannot fix what nobody has told you about, and the locksmith cannot sell a replacement he does not know is needed. The whole danger lives in the gap between the burglar knowing and the manufacturer finding out.