Zero-Day vs N-Day: What Actually Threatens Most Organizations

The Zero-Day Myth

Zero-days dominate cybersecurity headlines. They're dramatic, terrifying, and make for great conference talks. But here's the uncomfortable truth: the vast majority of successful attacks use known, patched vulnerabilities.

Definitions

• Zero-day (0-day): A vulnerability with no available patch at the time of exploitation. The vendor doesn't know about it, or hasn't released a fix yet.
• N-day: A vulnerability that has been publicly disclosed and (usually) patched, where N is the number of days since disclosure.

The Data

Multiple industry reports paint the same picture:

• Google's Threat Analysis Group tracks zero-day exploitation annually and consistently finds that n-day exploitation far outpaces zero-day exploitation in observed campaigns.
• Mandiant's M-Trends report consistently shows that exploitation of known vulnerabilities is among the top initial access vectors, not zero-days.
• Verizon's DBIR has reported for years that exploitation of known vulnerabilities is a top-3 initial access vector across all breach categories.

The reason is simple economics. Zero-day exploits are expensive to develop or purchase ($50K–$2M+ on the legitimate market). Known CVEs with public exploit code are free. Why spend seven figures when searchsploit will give you a working exploit for a two-year-old bug that half the internet hasn't patched?

The Exploitation Window

The dangerous period for most organizations isn't the zero-day window (before a patch exists). It's the n-day window, the time between a patch being available and your organization actually applying it.

Typical timelines:

• 1–7 days after CVE publication: security researchers and attackers analyze the vulnerability
• 7–14 days: proof-of-concept exploits start appearing
• 14–30 days: exploit code is polished and integrated into toolkits
• 30–90 days: automated scanning for the vulnerability becomes widespread
• 90+ days: the vulnerability becomes "background radiation", continuously scanned, continuously exploited against the long tail of unpatched systems

If your patching cadence is 90 days, you're leaving a 60+ day window where your systems are vulnerable to known, weaponized exploits.

Real-World Examples

Log4Shell (CVE-2021-44228), The patch was available within days. Yet months later, organizations were still being compromised because they hadn't updated. The zero-day window was measured in hours. The n-day exploitation window lasted years.

MOVEit Transfer (CVE-2023-34362), Cl0p ransomware group exploited this shortly after disclosure, but continued successfully attacking organizations for months because many didn't patch promptly.

ProxyShell / ProxyLogon, Microsoft Exchange vulnerabilities from 2021 were still being actively exploited in 2024 against unpatched servers. Three years of n-day exploitation from a single disclosure.

What This Means For Your Security Posture

1. Patching speed is your primary defense. Not firewalls, not EDR, not zero-trust architecture. Those all help, but if you patch known vulns within 14 days, you eliminate the majority of your attack surface.

2. Focus on what's exploited, not what's theoretical. The KEV catalog and EPSS scores tell you which n-days are actually being used. Prioritize those over high-CVSS vulnerabilities that nobody is exploiting.

3. Zero-day defense is a different (and expensive) game. If you're worried about zero-days, you need endpoint detection, network segmentation, behavioral analysis, and a mature incident response program. That's a $$$$ investment. Patching n-days is nearly free.

4. Your biggest risk isn't exotic. It's the Apache Struts bug from 2017 that's still running in production because nobody owns that legacy app. It's the WordPress plugin that auto-updated everywhere except your staging server. It's the container base image that hasn't been rebuilt in 9 months.

The Takeaway

Worry less about zero-days. Worry more about the CVEs published last month that are sitting in your backlog unpatched. That's where the attacks are.

Build a process that gets patches applied within 14 days for critical vulnerabilities and 30 days for everything else. Monitor the KEV catalog and high-EPSS CVEs against your stack. That alone puts you ahead of 90% of organizations.