What Is a Zero-Day Vulnerability?
Key takeaways
- A zero-day is defined by the absence of a patch, not by the severity of the flaw, so a trivial bug and a critical remote code execution are both zero-days while they are unpatched.
- Once a patch ships, the same flaw becomes an n-day, and the mass exploitation that follows the announcement is what usually reaches Indian businesses.
- Exploit code for a disclosed flaw is often published within days, and worms have automated the process within weeks.
- Most successful intrusions in Indian small and mid-size firms do not depend on a zero-day at all, but on a missing update that was available for months.
- Exploitability, exposure and business criticality decide the patching order, and in most Indian offices the first two are never written down.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
How does a zero-day become known, and what happens next?
There are three common routes. A researcher finds the flaw and reports it privately to the vendor, sometimes with a deadline for a fix, and disclosure may or may not be coordinated. An attacker finds it and uses it quietly, which is what makes a zero-day valuable. Or a malware sample caught in the wild is reverse engineered and the flaw is identified, usually after the attacker is already using it. In the first case, the vendor ships a fix and the researcher's write-up becomes public, at which point a flood of scanning and exploitation begins. That moment, not the original discovery, is when most Indian businesses are at risk, because scanners find exposed systems within hours of the news.
What can I do while no patch exists yet?
You reduce the attack surface and you watch. Reduce exposure by removing internet-facing systems that do not need to be exposed, restricting administration interfaces to a jump host or a VPN, and closing unused ports. Compensate with controls that do not depend on the patch: application allow-listing, strict egress filtering so a compromised host cannot reach a command server, multi-factor authentication on every remote login path, and least privilege so a foothold buys little. Then watch for behaviour rather than signatures, since a brand new exploit has no signature yet. Write down the compensating controls for each critical system in advance, so that when the emergency arrives nobody is deciding under pressure.
How much does a zero-day really cost to defend against?
The honest answer is that the cost is not mainly technical. You cannot patch your way out of an unpatched flaw, so you spend on segmentation, monitoring, access control and process. For an Indian mid-size company, the realistic cost is a few lakhs of rupees for the compensating controls, plus the disruption of running an untested emergency change, plus the far larger loss of an actual breach. Most organisations will never face a genuine zero-day in their own environment. They will face the exploitation of a published flaw they chose not to patch, and that is the problem worth spending money on.
| Type | Definition | Defensive response |
|---|---|---|
| Zero-day | Flaw exploited before the vendor publishes a fix | Compensating controls, segmentation, behaviour monitoring |
| N-day | Flaw with a fix available, known for days or months | Patch on a defined SLA, verify the update landed |
| Misconfiguration | Secure software left in an insecure setting | Hardened baseline, configuration review, drift detection |
| Credential compromise | Valid password, no software flaw involved | Multi-factor authentication, password hygiene, monitoring |
| Supply chain | Trust in a supplier's software or update process | Vendor review, update verification, restricted privileges |
What are the frequently asked questions?
Get a straight answer on this
Send us a list of the ten software products your business actually depends on, and we will return a prioritised patch and exposure plan built around them.
Send us the details See pricing