A Zero-day Attack is a cyberattack that exploits a previously unknown vulnerability – a “zero-day vulnerability” – for which no patch or fix yet exists, because the software vendor and defenders are unaware of the flaw at the time it is exploited. The term “zero-day” refers to the fact that developers have had zero days to address the vulnerability: it is being exploited before they even know it exists, leaving no time to prepare a defense. This makes zero-day attacks especially dangerous, because the usual protections that rely on knowing about a vulnerability – patches, signatures, and specific defenses – are not available when the attack occurs.
Several related concepts clarify the terminology. A zero-day vulnerability is the underlying unknown flaw in software or hardware. A zero-day exploit is the technique or code an attacker develops to take advantage of that vulnerability. A zero-day attack is the actual use of that exploit against targets. Once the vulnerability becomes known and a patch is developed and released, it is no longer a zero-day, though attacks may continue against systems that have not yet applied the fix.
Zero-day attacks are prized by sophisticated attackers, including nation-state actors and well-resourced criminal groups, precisely because they offer a window of opportunity during which defenders have no specific protection. Attackers may discover these vulnerabilities through their own research, or obtain exploits through underground markets where zero-days can command high prices. Because defenders are unaware of the flaw, zero-day attacks can be highly effective and difficult to detect, and they may be used in targeted, high-value campaigns or, once disclosed or leaked, in widespread exploitation before defenders can patch.
The challenge zero-day attacks pose is fundamental: traditional signature-based and known-vulnerability-focused defenses – such as vulnerability scanners that check for known flaws, and security tools that block known attack patterns – are inherently limited against threats that are, by definition, unknown. This is a key reason why security strategies cannot rely solely on knowing about specific threats in advance.
Defending against zero-day attacks therefore emphasizes approaches that do not depend on prior knowledge of the specific vulnerability. These include defense-in-depth (layering multiple controls so that a single unknown exploit does not lead to full compromise), behavioral and anomaly detection (identifying malicious activity based on abnormal behavior rather than known signatures), the principle of least privilege (limiting what any compromised component can do), a positive security model (allowing only known-good behavior and thereby blocking unexpected activity, including novel exploits, by default), robust monitoring and rapid incident response (detecting and containing attacks quickly even if they cannot be prevented), and prompt patching once fixes become available (to close the window of exposure as fast as possible). Practices such as network segmentation, hardening, and reducing the attack surface also limit the impact of zero-day exploitation.
In the context of APIs and modern applications, zero-day attacks are relevant because APIs and their underlying components can contain unknown vulnerabilities, and because a positive security model – which is particularly well suited to APIs given their structured, well-defined expected behavior – can help defend against unknown attacks by permitting only conforming, legitimate requests and rejecting anything unexpected by default. Behavioral monitoring that understands normal API behavior can also help detect anomalous activity that may indicate exploitation of an unknown flaw. Ultimately, the zero-day attack embodies the reality that not all threats can be known in advance, and that resilient security must include defenses that protect against the unknown – through layering, least privilege, behavioral detection, default-deny models, and rapid detection and response – rather than relying solely on knowledge of specific, previously identified vulnerabilities.