What is a zero-day?
A zero-day is a vulnerability in software, firmware or hardware that attackers can exploit before the vendor has released a patch or official mitigation for it. The name refers to the number of days defenders have had to prepare: zero. A zero-day exploit is the code that abuses such a flaw, and a zero-day attack is its actual use. Once a patch or public advisory exists, the flaw is called an N-day.
Zero-days are particularly dangerous in OT environments, because systems there often run for years without updates or proper monitoring, and because even a published patch can only be installed in the next maintenance window.
🧠 What are the characteristics of a zero-day?
| Property | Explanation |
|---|---|
| No patch available | The vendor does not know about the flaw, or has not yet released a fix |
| Often already exploited | The flaw is discovered because attackers are using it in the wild |
| Hard to detect | No signatures exist yet, so antivirus and IDS rules do not recognise it |
| High value | Zero-days are scarce and expensive, and are mainly used in APT campaigns, espionage or via the supply chain |
| Limited lifespan | Once the vendor publishes an advisory or patch, the flaw becomes an N-day, almost always with a CVE number |
A zero-day is therefore not a separate type of vulnerability but a phase in its life cycle. The same flaw in a PLC web server is a zero-day as long as no patch exists, and an N-day as soon as the vendor publishes an advisory.
🔄 What is the difference between a zero-day and an N-day?
| Feature | Zero-day | N-day |
|---|---|---|
| Awareness | Only the discoverer or attacker | Public, with a CVE and advisory |
| Patch | Not yet available | Usually available, sometimes only a workaround |
| Detection | Based on behaviour and anomalies | Also via signatures and vulnerability scans |
| Typical attacker | State actors, spyware vendors | Also criminal groups and ransomware gangs |
| Approach | Contain, detect, isolate | Patch or compensate through vulnerability management |
Many successful attacks on OT use N-days rather than zero-days: patching in production environments is slow, so a flaw that has been known for months stays usable for a long time. Mandiant analysed 138 vulnerabilities exploited in 2023: 97 of them (70%) were first exploited as zero-days, and the average time-to-exploit fell from 32 days (2021–2022) to five days. For OT this means the window between “zero-day” and “widely exploited N-day” is shorter than the usual patch cycle.
🏭 Which zero-days have hit industrial systems?
| Incident | Zero-day | Lesson for OT |
|---|---|---|
| Stuxnet (discovered 2010) | Four Windows zero-days, including flaws in shortcut handling (MS10-046) and the print spooler (MS10-061) | An air gap does not stop an attack via USB and project files |
| TRITON (2017) | Privilege escalation in the firmware of the Triconex Tricon MP 3008 (versions 10.0–10.4, CVE-2018-7522) | Even a safety system can contain an unknown flaw |
| Ivanti Connect Secure (January 2024) | Two chained zero-days (CVE-2023-46805 and CVE-2024-21887) in a VPN gateway | Access equipment at the network edge is a favourite target |
| Hypothetical | Flaw in a PLC web interface or HMI firmware | Remote code execution or manipulated operator information without logging |
Stuxnet also abused a hard-coded database password in WinCC, but that had been public since 2008 and was therefore not strictly a zero-day. The Google Threat Intelligence Group counted 75 zero-days exploited in 2024 (98 in 2023). 44% targeted enterprise products, and 20 of those 33 were in security and networking equipment such as VPN gateways and firewalls. Those are exactly the systems that provide remote access to OT networks.
🔐 How do you protect OT against zero-days?
There is no patch for an unknown flaw, so defence focuses on limiting the damage and spotting exploitation quickly. That is the core of Defense in Depth.
| Measure | What it does against zero-days |
|---|---|
| Network segmentation | Limits lateral movement; a compromised system cannot reach control directly |
| Anomaly detection | Recognises abnormal behaviour and new connections without a signature |
| Application Whitelisting | Only approved programs may run, even if an exploit succeeds |
| SBOM and asset inventory | Shows within hours whether a newly reported flaw exists in your plant |
| Threat Intelligence | Warns as soon as exploitation is seen in the wild, often before the patch |
| Patch management | Installs the fix once it exists, prioritising actively exploited flaws |
| Incident Response Plan | Procedures ready for temporary mitigation, isolation and recovery |
Step-by-step response to a newly reported zero-day
- Determine exposure - search the asset inventory and SBOM for systems that contain the vulnerable product or library.
- Assess reachability - can the system be reached from the internet or the office network, or only from a protected zone?
- Apply temporary mitigations - follow the vendor’s workaround, block ports or services, or use an IPS rule as a virtual patch.
- Tighten detection - add extra monitoring on the affected zone and use threat hunting to look for traces of earlier exploitation.
- Patch as soon as it is safe - test in a representative environment and plan the maintenance window, prioritising flaws on the KEV list.
- Review - record what worked and adjust segmentation and policy.
🧱 Which rules apply in the Netherlands and the EU?
- Cyber Resilience Act - from 11 September 2026, manufacturers must report actively exploited vulnerabilities via the ENISA platform: an early warning within 24 hours, a notification within 72 hours and a final report no later than 14 days after a corrective measure is available (see CRA Reporting Obligations).
- Cyberbeveiligingswet - the Dutch implementation of NIS2 has been in force since 15 August 2026. Exploitation of a zero-day that leads to a significant incident falls under the reporting obligation to the CSIRT, which is the NCSC for most sectors.
- IEC 62443 - part IEC 62443-4-1 requires vendors to have a process for handling reported vulnerabilities and releasing updates, and IEC 62443-3-3 describes zones and conduits that limit the impact of a flaw.
- Responsible Disclosure - researchers first report a discovered flaw confidentially to the vendor. Google Project Zero applies a 90-day deadline before details are made public.
❓ Frequently asked questions
Why is it called a zero-day?
The term zero-day refers to the number of days the vendor and defenders have had to fix a flaw: zero. At the moment an attacker exploits a zero-day, no patch exists yet.
How common are zero-days?
The Google Threat Intelligence Group counted 75 zero-days exploited in the wild in 2024 and 98 in 2023. The real number is probably higher, because not every exploitation is detected or reported.
Are zero-days in PLCs and other OT equipment common?
Zero-days in PLCs and safety controllers are rare, because developing them requires specific hardware and deep expertise; TRITON is one of the few known examples. Zero-days more often hit the IT systems around OT, such as Windows engineering workstations, VPN gateways and firewalls.
Does an air gap protect against zero-days?
An air gap reduces the attack surface but does not fully protect against zero-days. Stuxnet showed that malware can reach an isolated network via USB sticks and project files and exploit unknown flaws there.
What is a virtual patch against a zero-day?
A virtual patch is a rule in an IPS or firewall that blocks exploitation of a vulnerability without changing the vulnerable system itself. In OT a virtual patch bridges the period until the next maintenance window, but it does not replace the real patch.
Do I have to report a zero-day under the Dutch Cyberbeveiligingswet?
As a user you do not have to report a zero-day as such, but you do have to report a significant incident caused by its exploitation. Manufacturers of products with digital elements must additionally report actively exploited vulnerabilities within 24 hours under the Cyber Resilience Act from 11 September 2026.
📌 In summary
A zero-day is a flaw for which no patch exists yet, which puts it beyond the reach of signature detection and regular patch cycles. For OT, where systems run for a long time and patching is slow, patching alone is therefore never enough.
Zero-days are invisible threats that can hit any system, no matter how up to date it appears. If you have segmentation, monitoring, an up-to-date asset inventory and a rehearsed response plan in place, you limit the damage from the flaw nobody knows about yet.