Key takeaway
Installing a fix does not remove the need to investigate possible prior compromise. Choose measures according to exposure and evidence, using the authority defined in the incident plan.
What zero-day means
A zero-day attack exploits a previously unknown software, hardware or firmware vulnerability. This does not mean nobody knows about the flaw: an attacker may know it exists. The vulnerability is the system defect; an exploit is a method or code that uses it. Outcomes may include unauthorized access, code execution, data loss or service disruption. Operating systems, applications, cloud platforms and connected devices present different attack surfaces.
Disclosure, patch and exploitation are different states
Discovery, vendor notification, public disclosure, fix release and exploitation in an attack are separate facts, rather than a fixed timeline. Not every CVE record is immediately public, and not every disclosed flaw already has a patch. A flaw such as Heartbleed existing for a long time does not by itself establish when exploitation occurred. Separate the event from its supporting evidence in reports.
| Information | What it establishes | What it does not establish |
|---|---|---|
| Public advisory or CVE | A flaw is documented | Exploitation in your environment |
| Vendor patch | A fix is available for specified versions | Installation or removal of existing compromise |
| Observed exploitation | There is evidence that attackers used the flaw | That every installation is affected or compromised |
What past incidents show
Stuxnet (2010) used multiple Windows vulnerabilities. Exploitation of on-premises Microsoft Exchange servers in 2021 preceded fixes and continued against unpatched systems. Heartbleed is a memory-disclosure flaw; its existence does not establish whether exploitation occurred before disclosure. Chrome exploitation cases underline the need to update user applications promptly. Connect these examples to update and suspicious-activity investigation plans.
Detection and containment
A signature database may not recognize an unknown exploit. Unexpected application commands, sensitive-file access, privilege changes and outbound connections are investigation signals; correlate them with device, account, network and timeline context. Sandbox observations may be incomplete and need comparison with other evidence. Do not open a suspicious file on an ordinary work device; refer it to the approved analysis process. Authorized responders should choose proportionate containment under the incident plan while preserving relevant evidence.
Reduce the opportunity for impact
Give user and service accounts only necessary privileges, restrict service access, segment networks at trust boundaries and protect backups separately. Evaluate vendor mitigations; apply available fixes promptly through validation and change control. If no patch exists, agree measures such as disabling a service or changing its configuration with the risk owner. Installing a patch does not replace investigation of suspected prior compromise.