Defining Zero-Day

As we get flooded with vulnerabilities, we need better defined terms

The term zero-day is ubiquitous in cybersecurity. Yet, like many of our terms, it means different things to different people. This can be problematic - the more our terms lack common meaning, the more we risk miscommunication¹.

Anthropic’s Mythos has brought discussions of vulnerabilities to the forefront of cybersecurity discussions and into mainstream conversations, making this an opportune time to discuss and clarify terms like zero-day.

A zero-day is, first and foremost, a case of information asymmetry. An adversary knows something its target does not. When it is more broadly discovered that an unknown vulnerability has been used against targets, it is said to be a ‘zero-day’, because it has been zero days since it was discovered.

Definitions

Here’s what I came up with after reviewing over a dozen definitions from a wide variety of sources². There were more disagreements than agreements.

• A software bug is a defect in software³.

• A software vulnerability is an exploitable software bug that could cause harm if exploited by adversaries.

• A zero-day is a vulnerability in software or systems that is unknown to defenders.

Gorgeous. These look worth dying on. Photo by Claudel Rheault on Unsplash

Why is this important?

The term zero-day should evoke a need for immediate action. This urgency is lost if we apply this term to every newly discovered vulnerability.

Anthropic, in its announcement of Mythos, defined zero-day vulnerabilities as:

“bugs that were not previously known to exist.”

A phrase I often find myself saying when discussing vulnerability management is, “if everything is critical, nothing is critical.” The need for prioritizing vulnerabilities grows as the rate of vulnerability discovery goes up. When a vendor discovers vulnerabilities and makes them the focal point of a marketing campaign, it’s no surprise when their importance is over-inflated.

The other reason it was important to draw attention to the definition of zero day was the lack of consensus in the industry.

After pulling dozens of definitions, I found that many definitions hinged on whether or not a patch was available. This moves the definition of the “zero” in zero-day from information asymmetry to patch availability. This didn’t make sense, as a patch is just one way to mitigate attacks against a vulnerability.

Since we’re living in a time where it’s often not possible to patch a vulnerability before exploitation begins, it’s important for folks to know that they have other options to prevent exploitation. In 2026, no one should be waiting on a patch to address a zero day.

When does a zero day stop being a zero day?

A zero-day vulnerability ceases to be a zero-day when defenders gain enough knowledge to mitigate the vulnerability.

Conclusion

As the rate of vulnerability discovery increases, it is more important than ever to identify truly dangerous vulnerabilities. The term zero-day should be reserved for vulnerabilities that demand immediate focus and response. Kim Zetter’s hall-of-fame book on Stuxnet is titled Countdown to Zero Day because zero-day vulnerabilities are dangerous. At the time, it was unheard of for a piece of malware to use multiple zero-day vulnerabilities⁴.

AI companies are now security companies. The same caution we take with security vendor hyperbole now needs to be applied to security claims from OpenAI and Anthropic as both struggle to justify their lofty valuations. It clearly benefits foundation AI companies to lock software companies into an endless cycle of AI generated code, AI-driven scans, and AI-generated fixes. On that topic, I have another post:

1. This is my fancy way of saying people on the Internet are using the term zero-day wrong.

2. Wikipedia, Kim Zetter, Symantec (historical), IBM, Fortinet, Splunk, Crowdstrike, HPE, Safe Security, Universities, SANS, NIST, Google Project Zero, Google Mandiant

3. https://en.wikipedia.org/wiki/Software_bug

4. Stuxnet contained four zero-day exploits.