Zero-day vulnerability
A zero-day is a security flaw that attackers know about and can use before the software maker has released a fix, so defenders have had zero days to patch it. Cyber Essentials does not use the term. Its 14-day rule runs from the release of a fix, so once one exists it must be installed within 14 days (A6.4, A6.5).
- Term
- Zero-day
- Also known as
- 0-day, Zero-day exploit
- Category
- Devices and software
- Requirement area
- 3. Security Update Management
- Questions
- A6.4AUTO-FAILA6.5AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term zero-day mean in Cyber Essentials?
A zero-day is a security flaw that attackers know about and can use before the software maker has released a fix, so defenders have had zero days to patch it.
How does zero-day apply to Cyber Essentials?
In plain terms
Imagine burglars find a way to open a popular brand of lock before the lock maker knows about it. Until a new lock is made, every door fitted with that brand is exposed, however careful the owner is. That window, when the flaw is known to attackers but no fix exists, is what makes a flaw a zero-day.
What Cyber Essentials asks
The scheme documents do not mention zero-days. The security update requirement says software must be "updated, including vulnerability fixes, within 14 days of release", so the clock starts when the vendor releases a fix. Cyber Essentials Plus test case 2 works the same way: a fail is recorded where "the vendor has provided a vulnerability fix which has been available for more than 14 days".
A fix does not have to be a full update. The NCSC definition of vulnerability fixes includes "configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability". If a vendor publishes a setting change to block a zero-day before a patch is ready, that counts as a fix.
Common mistakes
- Waiting for the 14th day. The NCSC says "It's important that updates are applied as soon as possible", and a zero-day that attackers are already using is the clearest case for going faster.
- Ignoring a vendor's published workaround because a full patch has not arrived yet.
See the security update management requirements. Related: vulnerability fixes, security update, exploit.
Related terms
- Vulnerability fixesVulnerability fixes are patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability.
- Security update (security patch)A security update is a fix released by a software maker to close a known weakness that attackers could use to break in.
- ExploitAn exploit is a piece of code or a technique that takes advantage of a security flaw in software to make it do something its makers never intended, such as letting an attacker in.
- Auto-run (AutoRun and AutoPlay)Auto-run is a feature that opens or runs a file automatically, without asking, for example when a USB stick is plugged in or a download finishes.
- Browser extensionA browser extension is a small add-on program that adds a feature to a web browser, such as a password manager, ad blocker or PDF tool.
- BYOD (bring your own device)BYOD, short for bring your own device, means staff using their own personal phones, tablets or computers to do work.
Frequently asked questions
A zero-day is a security flaw that attackers know about and can use before the software maker has released a fix, so defenders have had zero days to patch it.
In the 2026 Danzell question set, zero-day comes up at A6.4, A6.5. Read those questions against the definition above so your answers use the term the way the assessor will.
Zero-day relates to 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.