# Zero-Day Exploit **Entity class:** Cyber capability **Domain:** Cybersecurity / vulnerability exploitation **Maturity:** Developed ## Definition A **zero-day exploit** is code or a technique that takes advantage of a hardware, firmware, or software vulnerability before defenders have an effective patch or established detection. NIST defines a zero-day attack as one exploiting a previously unknown vulnerability. The term remains technical. A terrorism event is not literally a CVE-class software exploit merely because defenders failed to anticipate it. The rigorous bridge is [[wiki/Zero-Day Threat Model|zero-day-like threat-model exploitation]]: the adversary operationalizes a path the institutional defensive architecture has not converted into controls, training, detection, or response. ## Counterterrorism Relevance Zero-days can provide access to communications, identities, financial systems, logistics, media channels, operational technology, or critical infrastructure. That makes the cyber layer structurally relevant to [[wiki/Counterterrorism|counterterrorism]] and [[wiki/Cyberterrorism|cyberterrorism]], not a decorative add-on. The same capability can be used by states, criminals, researchers, vendors, intelligence services, or terrorists; attribution and intent must be established independently. Zero-day defense includes attack-surface reduction, secure design, segmentation, least privilege, monitoring, incident response, threat intelligence, rapid patching once a fix exists, and resilience when prevention fails. September 11 sits between pure novelty and an unpatched known vulnerability. Suicide hijacking had been contemplated, but the system had not operationalized that possibility throughout aviation security. Oklahoma City is closer to an [[wiki/N-Day Exploit|n-day]] institutional exploit because the general vehicle-bomb attack class was known while facility hardening remained incomplete. ## Relationships - **security domain:** [[wiki/Cybersecurity|Cybersecurity]]. - **systems analogue:** [[wiki/Zero-Day Threat Model|Zero-Day Threat Model]], [[wiki/Threat Model Failure|Threat Model Failure]], and [[wiki/Failure of Imagination|Failure of Imagination]]. - **potential operational use:** [[wiki/Cyberterrorism|Cyberterrorism]]. - **detection layer:** [[wiki/Real-Time Observability|Real-Time Observability]]. - **can enable:** data theft affecting [[wiki/Identity and Relationship Analysis|Identity and Relationship Analysis]] or disruption of critical infrastructure. ## Sources / Provenance - [NIST Computer Security Resource Center — zero-day attack](https://csrc.nist.gov/glossary/term/zero_day_attack) - [CISA — Cyber Storm VIII after-action report](https://www.cisa.gov/sites/default/files/2023-02/final-cyber-storm-viii-after-action-report-082022.pdf)