How a zero-day vulnerability works
A researcher or attacker discovers a flaw in software or hardware that the vendor has not yet identified. If attackers use it first, they can compromise systems for as long as the flaw remains unknown or unpatched.
Once the vendor learns of it, they develop and release a patch, and the vulnerability is typically assigned a CVE identifier. After disclosure, it is no longer strictly zero-day, though many organizations stay exposed until they apply the update. The market for undisclosed flaws includes researchers who report them responsibly, brokers and criminal groups, which is why timely patching after disclosure is so important to defenders.
Why it matters for Canadian organizations
Because no signature or patch exists, traditional preventive tools may miss exploitation. Internet-facing systems such as VPNs, firewalls and email servers are attractive targets and have been repeatedly hit.
The Canadian Centre for Cyber Security issues urgent alerts when serious flaws are exploited. Fast response affects whether personal information is exposed, which in turn determines PIPEDA and Law 25 notification duties. Mitigations such as disabling an affected feature, blocking a port or applying a vendor workaround are often published before a full patch, and acting on them quickly can prevent compromise.
How to defend against it
Reduce exposure by limiting internet-facing services, segmenting networks and applying least privilege so one exploited system cannot reach everything. Maintain an asset inventory to know quickly where affected software runs.
Use behavior-based detection such as EDR and 24/7 monitoring to catch post-exploitation activity. Subscribe to vendor and government advisories, apply patches or mitigations as soon as they appear, and rehearse an emergency patching process. Document who is responsible for emergency changes and how fast systems can be updated or isolated, so teams are not deciding roles during an active exploitation event.
Frequently asked questions
What is the difference between a zero-day and a known vulnerability?
A zero-day is unknown to the vendor and has no patch. A known vulnerability has been disclosed and usually has a fix or mitigation. Most successful attacks use known flaws that organizations have simply not patched. Timing is the main difference.
Can you protect against zero-day attacks?
You cannot patch what has no fix, but you can limit impact through segmentation, least privilege, hardened configurations, behavior-based detection and rapid incident response. Prompt patching once a fix appears is also critical. Early patching and monitoring help most.
Are zero-day vulnerabilities common?
Zero-days are discovered regularly, but most intrusions use older, known vulnerabilities. Zero-days tend to be used in targeted attacks by well-resourced groups until they are disclosed, after which exploitation often becomes widespread. Disclosure changes the risk quickly.
Related service: Vulnerability management