Secordit home
Contact

What is a zero-day?

Security teams use zero-day for a recently discovered weakness that is not yet publicly known, or for which a vendor fix is not yet available. That is the NCSC's description. These weaknesses are often used first against higher-value targets. Once a weakness becomes public, ready-made attacks can follow. 12

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. A weakness is discovered before it is widely known, or before a vendor fix is available. 1
  2. It may be used first against higher-value targets. When it becomes public, unpatched systems can then be at risk. 12
  3. Ordinary readers cannot scan the internet for zero-days. The useful actions are to keep software supported and updated, and to follow vendor or NCSC advice when a serious issue is announced. 12

How it can look

A 2024 advisory from the NCSC and allied agencies gave a 2023 figure. Of the top routinely exploited vulnerabilities that year, most were first exploited as zero-days, marking a shift from 2022. That figure is from that 2024 advisory. 2

Warning signs

  • A vendor or the NCSC announces a serious weakness, and an update is available but has not been applied. 12
  • A device or application is still in use after the vendor has stopped supporting it. 1
  • A message uses the word zero-day to create panic and to sell an unsolicited fix. 1

What to do now

  1. Keep software supported and updated, including after a newly public weakness, because fixes often follow once it is known. 12
  2. When a serious issue is announced, follow the vendor's instructions or NCSC advice, using websites you already trust. 2
  3. Do not try to hunt for unknown weaknesses on other people's systems. 1

UK reporting and support

  • If you think a device is infected or an account has been taken over, follow the NCSC help for individuals. 3
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 456
  • If someone is in danger, call 999. 56

How to protect yourself

  • Apply updates when they appear, and replace software or devices that no longer receive them. 1
  • Watch vendor and NCSC announcements for serious issues that affect what you run. 2
  • Keep a simple list of important systems so you know what needs an update when a weakness is announced. 1

Frequently asked questions

If a weakness is a zero-day, does that mean there is nothing I can do?

You cannot scan the internet for unknown weaknesses. You can still keep software supported and updated, and follow vendor or NCSC advice when a serious issue is announced. Once a weakness becomes public, applying the fix still matters. 12

Is a zero-day the same as any vulnerability?

A vulnerability is any exploitable weakness. A zero-day is a recently discovered one that is not yet publicly known, or for which a vendor fix is not yet available. 1

Where does the 2023 figure come from?

A 2024 advisory from the NCSC and allied agencies gave a 2023 figure. Of the top routinely exploited vulnerabilities that year, most were first exploited as zero-days, marking a shift from 2022. 2

Matching kit

First Hour After a Breach · £29 · Digital download.

An incident-response planning kit for UK small businesses. It is not a live incident-response or legal service.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Understanding vulnerabilities | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  2. NCSC, UK and allies warn about shift in cyber attackers exploiting zero-day vulnerabilities | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. NCSC, Help for individuals | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  5. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  6. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).