What is a zero-day vulnerability?
Short answer
A zero-day is a vulnerability that attackers know about or exploit before the vendor has released a fix, so defenders have had "zero days" to patch. Once a patch exists, the urgent job is to install it, because attackers quickly target systems that remain unpatched.
The details
You cannot patch a flaw nobody has fixed, so defense in depth matters: least privilege, network segmentation, monitoring and vendor-recommended mitigations reduce the damage while you wait.
Useful next reads and tools
Terms explained
- Zero-day
- A zero-day is a vulnerability that is exploited or known to attackers before the vendor has a fix available.
- Least privilege
- Least privilege means giving each user, service or AI agent only the access it needs to do its job, and no more, for only as long as it needs it.
Sources
Related questions
Related Guides
GuideSOC
9 Quick-Win AI Agent Use Cases for Security Operations
Nine high-impact, low-effort SOC tasks to hand to AI agents first, what each agent does and the metric that proves it, plus the tasks to keep human.
Read more GuideSOC
How to Build an Agentic SOC: A 4-Phase Roadmap for AI Security Operations
A practical roadmap for moving a SOC to AI agents: build the data foundation, start with quick wins, customize and orchestrate agents, and keep humans in command.
Read more GuideSOC
6 SOC Functions to Automate With AI Agents (and What to Keep Human)
Which SOC tasks should AI agents handle and which need a human? A function-by-function guide to automation potential, the AI role, the human role and the outcome.
Read more GuideSOC
How I Investigate a Suspicious PowerShell Alert in a SOC Lab
A walkthrough of the exact triage workflow, event correlation steps, and command-line decoding techniques used to analyze suspicious PowerShell execution.
Read more