8/14/2026 • 5 min read
A zero-day attack exploits a vulnerability that no one knows about yet—not the vendor, not your team, and not your security tools. No signature, no alert, no patch. In recent months, the threat landscape has evolved. Security appliances have become prime targets, while AI is accelerating the discovery and exploitation of vulnerabilities. Attackers now have increasingly fast ways to reach systems and sensitive data. When facing zero-days, detection and patching are no longer enough. Security must also limit what an attacker can reach once a vulnerability has been exploited. Restricting access, controlling permissions, and protecting data directly can reduce the impact of a compromise, even when the intrusion itself could not be prevented.
The term zero-day refers to a vulnerability that is discovered or exploited while still unknown to the vendor and before a patch is available. Some vulnerabilities can remain present for years before being discovered. When they begin to be exploited before a patch exists, they become a zero-day threat.
Log4Shell is one of the best-known examples. This critical vulnerability in the Java Log4j library had been present since 2013 but was not discovered until 2021. Because Log4j was embedded in a vast number of software products and services, millions of systems were exposed when the vulnerability was disclosed. At the peak of its exploitation, more than 100 attacks per minute were observed, according to IBM. A vulnerability that had remained invisible for years became a large-scale threat within days.
In 2024, 44% of the zero-days tracked by Google targeted enterprise technologies. Among these attacks, 60% targeted security and networking appliances, including VPNs, firewalls, and management tools (GTIG, 2025).
These appliances often have privileged access and sit directly in the path of sensitive data. Compromising them can allow attackers to bypass certain controls and progressively expand their access far beyond the system initially affected.
In 2025, ANSSI documented an example with the “Houken” campaign. Attackers chained several zero-day vulnerabilities in a remote access appliance to compromise French organizations across government, finance, telecommunications, media, and transportation. They executed code remotely, stole credentials, and exfiltrated data (ANSSI/CERT-FR, 2025).
Key takeaway. Firewalls, VPNs, and other security appliances remain essential, but their presence alone is not enough to establish trust. When one of these appliances is compromised, controls governing access and data must continue to operate independently of this first line of defense.
AI is accelerating the discovery of vulnerabilities. Vulnerabilities that remained unknown for years can now be searched for automatically and at scale.
In April 2026, Anthropic introduced Claude Mythos Preview, a model whose cybersecurity capabilities were tested, among other things, on vulnerability research. The following month, the company reported that the model, used with around fifty partners as part of Project Glasswing, had helped identify more than 10,000 high- or critical-severity vulnerabilities in widely used software. These included a vulnerability that had been present in OpenBSD for 27 years and another that had existed in FFmpeg for 16 years.
Research that once required experts to spend weeks investigating can now be carried out much faster. For organizations, the main risk is that the time available between the discovery of a vulnerability and the first exploitation attempts is shrinking.
Key takeaway. AI is accelerating vulnerability research for both attackers and defenders. It can help identify and patch certain vulnerabilities faster, but it can also accelerate their discovery and exploitation by malicious actors.
An unknown vulnerability can allow an attacker to bypass an initial security layer and gain access to a system. However, that access should not automatically give them access to data.
In a Zero Trust approach, security controls multiply as you move closer to sensitive data. Trust established at one level does not carry over to the next, and every access request remains controlled according to the permissions that are actually required.
When a zero-day attack bypasses one security layer, the remaining layers continue to limit the attacker’s ability to move further. Even after compromising an appliance or an account, the attacker must still overcome the controls protecting the data itself. The goal is to ensure that compromising a single layer is never enough, on its own, to expose the data.
Zero-days are not going away. There will always be vulnerabilities discovered too late to prevent their initial exploitation. Security therefore cannot rely solely on the ability to detect and patch vulnerabilities in time.
When an attacker gains access, the permissions associated with that access determine what happens next. The more limited those permissions are, the less data the attacker can reach and the less they can move through the organization.
It is not always possible to prevent the exploitation of an unknown vulnerability. But it is possible to prevent it from providing access to more data than necessary.
If you would like to learn more about implementing a data-centric Zero Trust architecture, contact us for a demo.
