View source for Definition:Zero-day exploit

🛡️ '''Zero-day exploit''' is an attack that targets a previously unknown [[Definition:Vulnerability | vulnerability]] in software or hardware — one for which no patch or fix exists at the time of exploitation — and it represents one of the most unpredictable and potentially catastrophic [[Definition:Cyber risk | cyber risks]] that [[Definition:Insurance carrier | insurers]] must account for when underwriting [[Definition:Cyber insurance | cyber insurance]] portfolios. The name reflects the reality that defenders have had "zero days" to prepare, leaving even well-secured organizations exposed until a remediation becomes available.

🔍 From an [[Definition:Underwriting | underwriting]] standpoint, zero-day exploits challenge traditional risk assessment methods because they cannot be detected by standard [[Definition:Vulnerability scanning | vulnerability scanning]] — by definition, the flaw is not yet catalogued. Threat actors may leverage a zero-day to deploy [[Definition:Ransomware | ransomware]], exfiltrate sensitive data, or establish persistent access across thousands of organizations simultaneously, which is precisely what makes this peril a significant source of [[Definition:Aggregation risk | aggregation risk]]. A single zero-day in widely used software — an operating system, a [[Definition:Managed file transfer (MFT) | file transfer tool]], or a cloud platform — can trigger correlated [[Definition:Claim | claims]] across an insurer's entire [[Definition:Book of business | book of business]]. Carriers respond by stress-testing their cyber portfolios with scenarios modeled around systemic zero-day events, often in coordination with [[Definition:Catastrophe model | catastrophe modeling]] vendors and [[Definition:Reinsurer | reinsurers]].

⚠️ The growing frequency and sophistication of zero-day attacks have reshaped how cyber [[Definition:Insurance policy | policies]] are structured and priced. Many carriers have introduced [[Definition:Sublimit | sublimits]] or [[Definition:Coinsurance | coinsurance]] provisions for systemic software events, and some [[Definition:Exclusion | exclusions]] now carve out attacks attributed to [[Definition:Nation-state cyber attack | nation-state actors]], who are among the most prolific developers of zero-day capabilities. [[Definition:Insurtech | Insurtechs]] specializing in threat intelligence increasingly partner with underwriters to provide real-time alerting when a new zero-day surfaces, enabling rapid [[Definition:Exposure | exposure]] assessment and proactive communication with [[Definition:Insured | insureds]]. For the broader market, zero-day exploits underscore a fundamental truth about cyber risk: no amount of preventive security eliminates the possibility of a novel attack, which makes [[Definition:Risk transfer | risk transfer]] through insurance an essential layer of organizational resilience.

'''Related concepts'''
{{Div col|colwidth=20em}}
* [[Definition:Vulnerability]]
* [[Definition:Cyber insurance]]
* [[Definition:Aggregation risk]]
* [[Definition:Ransomware]]
* [[Definition:Vulnerability scanning]]
* [[Definition:Catastrophe model]]
{{Div col end}}