A zero-day attack is an attack that exploits a vulnerability that has not previously been patched by the software vendor. The software vendor must hurry to fix the vulnerability before more attackers become aware of and try to take advantage of the issue. Until a patch is issued, attackers can make use of the attack since there are no known defences against the new technique. Software can only become safe against the attack when a patch is released, and the software receives the update.

Zero-day attacks are not just useful for criminal attackers, but also for governmental cyber-attackers from security agencies. The NSA is known to hoard several zero-day attacks for use in its arsenal — something it has been criticised for. It decides whether or not to disclose these vulnerabililities based on its NOBUS principle.


Last updated: 3 September 2017