Defending Against Zero-Day Exploits

Updated 27 October 2026.

What is a zero-day?

The term gets used loosely. Precisely, a zero-day vulnerability is one the vendor has had zero days to fix. A zero-day exploit is working code that takes advantage of it. A zero-day attack is that code used against a real target. They aren't rare: in 2023, most of the top routinely exploited vulnerabilities were first exploited as zero-days, according to CISA and its partners.

Two things follow that matter for defense. There's no patch, so patch management has nothing to deploy. And there's no signature, because somebody writes a signature only after analyzing an attack that has already happened somewhere.

What does an exploit have to do?

It's worth being specific about the sequence, because the defensive opportunity is in the last step rather than the first.

• Reach the vulnerable code. Get input to the component that mishandles it, through a network service, a file, a document or an interface. When the service faces the internet, MITRE ATT&CK catalogs this as Exploit Public-Facing Application.
• Corrupt execution. Use the flaw to gain control of what the process does, through memory corruption, injection, a logic flaw or a deserialization bug.
• Establish control. Execute code in the context of the compromised process.
• Produce impact. And this is the part that matters: write a file, create a service, modify a registry key, alter configuration, encrypt data or move to another system.

The first three steps are where the novelty lives, and they're the steps a defender can't anticipate. The fourth step isn't novel. It looks the same as it did ten years ago, because the set of things an attacker can usefully do to a system hasn't grown as fast as the set of ways to get in.

Why do patch-dependent and signature-dependent defenses struggle?

None of these is a bad control. Each is structurally constrained here.

Patching needs a patch. By definition a zero-day has none. Once one ships, enterprise patch cycles run on testing and change management for good reasons. Attackers often don't wait: of the 491 vulnerabilities newly named as exploited in the first half of 2026, attackers were already exploiting 141 when those flaws went public, per the Zero Day Clock, read 24 October 2026.

Signatures need prior analysis. A signature describes an attack somebody has already seen. For a novel exploit there's nothing to describe, and the window between first use and first signature is the exposure.

Network-layer virtual patching needs a rule per vulnerability. IPS and WAF rules that block exploitation of a specific CVE are effective and widely deployed. OWASP defines virtual patching as an enforcement layer that blocks exploitation attempts against a known vulnerability without changing the vulnerable code (OWASP). A rule needs the vulnerability known well enough to write the rule, which puts it on the same timeline as signatures for anything novel.

Behavioral detection needs the behavior to look wrong. It catches many exploits, particularly ones producing unusual process behavior. It's the strongest of these four against novelty, and it still acts after execution has begun.

Which step of an exploit is never novel?

An exploit that gains code execution and then does nothing has cost the attacker a valuable capability for no return. To persist, encrypt data or move on, it has to change something.

That's the asymmetry worth building on. The exploitation technique can be unprecedented. The change it needs to make afterward is drawn from a small and stable set: files, processes, services, registry, configuration. It's the same set of changes that decides how attackers move laterally once they're inside.

A control that checks whether a change falls inside a system's authorized operating state doesn't care which vulnerability produced the attempt.

Mimic Networks profiles each protected server in its authorized state and checks each attempted change at the kernel before it executes. Virtual Patching works in two forms, and both require baselining. Disruption blocks the specific mechanism an analyzed vulnerability depends on, so the exploit doesn't succeed. Containment limits what an exploit can do once it lands, so one safeguard can cover a whole family of exploits. It's part of Mimic's known-good enforcement approach. The vulnerability stays in the code until the patch removes it. Mimic runs on Windows Server 2016 and later and Red Hat Enterprise Linux 8 and later.

This doesn't make patching optional. Patching removes the flaw and remains the correct long-term answer. Enforcement stops exploitation at the point of execution while patching runs, and it protects supported servers whose software will never get a fix.

The N-able N-central flaws of 2026 show the timeline. N-able shipped four hotfixes in five weeks, and CISA added three of the flaws to its catalog of known exploited vulnerabilities within three days of their CVE records (our write-up).