Zero-Day Vulnerability

A zero-day vulnerability is a previously undiscovered flaw in software, hardware or a system that the vendor is unaware of and has therefore had no opportunity to patch. Because no fix exists at the time it is found, a zero-day is especially valuable to an attacker: exploiting it faces no defence built specifically against that flaw, unlike a known vulnerability for which patches, signatures and detection rules already exist. The term 'zero-day' refers to the vendor having had zero days' warning before exploitation became possible. Vulnerability management has traditionally rested on a race between two sides: security researchers and vendors who search for flaws and issue patches, and attackers who search for the same flaws to exploit them, with the system remaining broadly tolerable because such discovery has historically been slow, expensive and dependent on scarce technical expertise. Artificial intelligence systems capable of independently and rapidly discovering zero-day vulnerabilities threaten to remove this scarcity constraint, since discovery could become cheap and fast while patching remains comparatively slow, requiring vendor action, testing, distribution, and in critical infrastructure, scheduled downtime for deployment. If AI-assisted discovery structurally outpaces patching capacity, the stock of exploitable, unpatched vulnerabilities grows over time rather than being contained, which is described as an 'inversion' of the discovery-to-patching relationship vulnerability management has traditionally relied on. This has direct implications for critical infrastructure, power grids, banking, health systems and telecom, where unpatched systems may remain exposed for extended periods due to the operational cost of downtime.

• 1 Zero-day vulnerability: a flaw unknown to the vendor, for which no patch yet exists at the time of discovery/exploitation.
• 2 Especially dangerous because no defence has been specifically built against it, unlike known, patched vulnerabilities.
• 3 Vulnerability management traditionally rests on a discovery-versus-patching race, historically slow and resource-intensive on both sides.
• 4 AI systems capable of independently discovering zero-days threaten to remove the scarcity constraint on discovery.
• 5 If discovery outpaces patching, the stock of exploitable unpatched vulnerabilities grows structurally rather than incidentally.
• 6 Patching critical infrastructure (power grids, banking, health, telecom) is slow due to the operational cost of scheduled downtime.
• 7 India's CERT-In (Indian Computer Emergency Response Team) is the national nodal agency for responding to such incidents.

AI-enabled zero-day discovery was cited as inverting the traditional vulnerability-management race, since attackers could locate exploitable flaws faster than vendors and critical-infrastructure operators can realistically patch them.