It was a precise technical concept for a mostly niche industry, specifically information security workers. An incredibly important industry, to be clear, but the total number of people in it is a fraction of a fraction. There’s been a lot of talk about zero days lately with LLMs getting good at creating them, but ten years ago I’d have expected more people to need to know “hypotension” (medical jargon) or “Roth IRA” (finance jargon) than needed “zero day.”
“Zero day” is a bit different from “we didn’t know about it.” As other commenters have mentioned, the zero in zero day is about how long a patch for the exploit is out. Put it another way; if tonight the New York Times wrote about a new exploit, and for some reason the entire security world collectively decided ‘nah, someone else will handle that, I’ve got other stuff to do than fix that one’ for a week, the exploit would still be called a zero day a week later. It’s known, but there’s no patch. Why is that important? Because the legion of competent information technology workers working at most companies are usually on top of things enough to apply updates and patches, but not capable of writing their own countermeasures.
Citation: Professional experience. I used to work I.T. for a university, and I knew to update computers I found that didn’t have their patches, and knew how to set things up so the network would prompt all the computers to update or at least tell me what computers I hadn’t gotten to yet. An exploit with a seven day old fix wouldn’t (in theory!) work on us. But that approach doesn’t work for exploits with no patch, and I couldn’t write the patch. (I usually didn’t have access to the source code for our software- like, imagine there’s an outright bug in the Windows login code, and Microsoft isn’t fixing it. Decompiling the source and fixing that is way above the pay grade for a random I.T. worker, and would have violated terms of service!) In practice, that’s fine. Microsoft had a lot of smart people working hard to fix any exploits they saw, and since exploits Microsoft hadn’t fixed yet were rare, nobody was going to use one to go after my employer.
TLDR: Zero day doesn’t mean ‘we don’t know about the exploit’ it means ‘nobody has published a fix for the exploit.’ That matters because most tech workers can counter exploits where there’s a published fix (they hit the “Apply Windows Update” button) but most can’t stop exploits where there’s no published fix.
It was a precise technical concept for a mostly niche industry, specifically information security workers. An incredibly important industry, to be clear, but the total number of people in it is a fraction of a fraction. There’s been a lot of talk about zero days lately with LLMs getting good at creating them, but ten years ago I’d have expected more people to need to know “hypotension” (medical jargon) or “Roth IRA” (finance jargon) than needed “zero day.”
“Zero day” is a bit different from “we didn’t know about it.” As other commenters have mentioned, the zero in zero day is about how long a patch for the exploit is out. Put it another way; if tonight the New York Times wrote about a new exploit, and for some reason the entire security world collectively decided ‘nah, someone else will handle that, I’ve got other stuff to do than fix that one’ for a week, the exploit would still be called a zero day a week later. It’s known, but there’s no patch. Why is that important? Because the legion of competent information technology workers working at most companies are usually on top of things enough to apply updates and patches, but not capable of writing their own countermeasures.
Citation: Professional experience. I used to work I.T. for a university, and I knew to update computers I found that didn’t have their patches, and knew how to set things up so the network would prompt all the computers to update or at least tell me what computers I hadn’t gotten to yet. An exploit with a seven day old fix wouldn’t (in theory!) work on us. But that approach doesn’t work for exploits with no patch, and I couldn’t write the patch. (I usually didn’t have access to the source code for our software- like, imagine there’s an outright bug in the Windows login code, and Microsoft isn’t fixing it. Decompiling the source and fixing that is way above the pay grade for a random I.T. worker, and would have violated terms of service!) In practice, that’s fine. Microsoft had a lot of smart people working hard to fix any exploits they saw, and since exploits Microsoft hadn’t fixed yet were rare, nobody was going to use one to go after my employer.
TLDR: Zero day doesn’t mean ‘we don’t know about the exploit’ it means ‘nobody has published a fix for the exploit.’ That matters because most tech workers can counter exploits where there’s a published fix (they hit the “Apply Windows Update” button) but most can’t stop exploits where there’s no published fix.