What is a zero-day vulnerability and can you test for it?

• A. A vulnerability unknown to defenders; you cannot reliably test for zero-days; focus on known weaknesses and defense.
• B. A zero-day is a vulnerability fixed yesterday.
• C. You can always detect zero-days with standard scans.
• D. Zero-days are irrelevant to pentests.

Answer: (A)

A zero-day vulnerability is a flaw that is unknown to defenders and vendors, with no patch or public signature yet available. Because it isn’t known, there’s no reliable way to test for it using standard vulnerability scanners or checks that target known weaknesses. In practice, a pentest focuses on known vulnerabilities and on strengthening defenses to detect or block exploitation attempts through defense-in-depth, patch management, network segmentation, and monitoring for unusual or anomalous activity. You can explore general exploit techniques or use threat intel to understand exposure, but you can’t guarantee detection of a true zero-day during testing.