Zero-day

How it works

• The maker has had zero days to fix it.
• Once a fix is released, attackers race to use it on machines that have not updated.
• Updating quickly shortens the window.
• Behaviour-based protection can catch an attack with no patch yet.

What can go wrong (example scenario)

A four-person consultancy used a small VPN appliance with a zero-day that was publicly disclosed on a Tuesday. The patch arrived Thursday. Nobody applied it. The following week an attacker used the flaw to get inside the network.

How WILDCARD handles it

Patch Management installs fixes as soon as they ship, which closes a zero-day fast. Workstation Defender fights zero-days on the computer itself by catching the behaviour, which covers the days before a patch exists.

• A law firm hears of a Chrome zero-day in the news and wants every browser updated today.
• A dental office's remote-access appliance has a published flaw and no patch yet, and needs to be taken offline until one ships.
• A retailer wants to know whether the zero-day in the headlines affects anything they run.

Example scenario: A small engineering firm read about a zero-day in a popular PDF tool. Their patching report showed every PC already on the fixed version by the next morning, because the update had been pushed overnight. Their EDR had also been watching the tool's behaviour in the meantime. Nothing happened.

A question owners ask

Can anything stop a zero-day?

Patching can't, until a fix exists. Behaviour-based detection can, because the attack still has to do something visible on the machine. That is why both cards sit in CORE.