---
title: "Zero-Day"
canonical: https://trickest.com/glossary/zero-day
description: "A zero-day is a vulnerability that attackers can exploit before the vendor has released a fix, leaving defenders no patch and limited time to respond."
---

# Zero-Day

A zero-day is a flaw that someone can exploit while the vendor has had zero days to ship a patch. The term covers both the vulnerability and, loosely, the exploit that weaponizes it. Until a fix exists, defenders rely on detection, compensating controls, and isolation rather than patching. Log4Shell (CVE-2021-44228) showed how fast a zero-day in a widely embedded component spreads: attackers scanned the internet for vulnerable instances within hours of disclosure.

Zero-days matter because they bypass the patch-management cycle that most defense assumes. An organization can be fully up to date and still fall, since no update addresses the flaw yet. For attackers, a working zero-day buys access that signature-based tools rarely catch on the first pass.

When a zero-day becomes public it gets assigned a [CVE](/glossary/cve) identifier, and the working code that triggers it is the [exploit](/glossary/exploit). [Threat intelligence](/glossary/threat-intelligence) feeds and any [indicator of compromise](/glossary/indicator-of-compromise) tied to active exploitation help defenders respond before a patch lands.

In Trickest you can build a workflow that watches for new disclosures and immediately scans your inventory for affected versions, so you measure exposure the moment a zero-day surfaces.

---
_Markdown source of https://trickest.com/glossary/zero-day._