Zero Day Is the New Every Day

Why the scarcity that once made zero-day attacks rare is gone, and what security teams should assume instead

A zero-day used to be a big deal because so few people could produce one. That scarcity is the whole reason "assume breach" stayed a slogan instead of a daily operating posture. Once the capability to find one is cheap, fast, and available to anyone with a grudge, the math changes, and so should the posture.

The Old Scarcity Model

For most of the last thirty years, zero-day vulnerabilities were rare because finding them was hard. It took specialized skill, time, and usually money: the kind of resource profile that limited the population of people who could do it to a small set of nation-state programs, well-funded criminal groups, and a handful of elite independent researchers. Everyone else was working from known vulnerabilities and public CVEs, which is exactly why patch cycles, MDM pushes, and signature-based detection were ever a reasonable defense in the first place. The threat was assumed to be occasional, because the capability to create it was scarce.

That scarcity was never a law of nature. It was an economic condition. And economic conditions change.

The Population of Attackers Just Got Much Bigger

As covered in The Edge Is the Vulnerability, frontier-grade vulnerability discovery has moved from a specialized skill to a commodity capability: open-weight, freely downloadable, and runnable on hardware an individual can own. That fact alone would be significant, but it's worth dwelling on what it actually does to the attacker population, because the shift isn't linear, it's combinatorial.

Nation-state-level attack capability used to require a nation-state's budget, or close to it. Now it requires a laptop and a model weights file. That collapses the cost of entry by several orders of magnitude, and cost of entry is the only thing that was ever keeping the pool of capable attackers small.

At the same time, the pool of motivated people has always been enormous and was never the limiting factor. Every large institution, public figure, employer, ex-partner, and government has people somewhere in the world who feel genuinely wronged by them, and no small number of those people would act on it if the barrier to acting were low enough. Add the growing pull of notoriety: the individual who wants to be known as the person who took down a bank, a hospital system, or a public official, and you have a large, globally distributed population with real motive that, until recently, simply lacked the means.

Means was the bottleneck. Now means are nearly free. Bad intentions, retribution, seeking attention, and a three-figure budget is all that is required.

Do the Math

You don't need a large fraction of that population to act for the volume of attacks to change categorically. If even a tiny sliver of the world's aggrieved, ideologically driven, or fame-seeking individuals gain access to a tool that can find exploitable flaws at nation-state quality, the number of active zero-day discovery efforts running in parallel at any given moment stops being small. It becomes background noise: constant, distributed, and impossible to attribute to a single threat actor profile because there isn't one anymore.

That's the shift the title is pointing at. Zero-day stops being an event you brace for and starts being a condition you operate inside of, the same way you operate inside the assumption that spam and phishing emails are arriving right now, somewhere, against someone in your organization, at all times.

Why "Patch Faster" Was Already the Wrong Race

Even before this shift, patch-and-detect was a reactive model racing against attackers who only had to be right once. Widening the pool of attackers who can find that "once" doesn't just increase the frequency of attacks, it compresses the window between discovery and exploitation across the board, because there's no longer a small, trackable set of actors whose tempo you can study and plan around.

Security teams built their entire operating cadence, patch windows, vulnerability disclosure timelines, incident response runbooks, around an attacker population that was slow and rare by construction. None of that changes the fact that the underlying assumption just broke.

Operating Like It's Already Every Day

The organizations that adapt well to this won't be the ones that get faster at patching, though speed still matters. They'll be the ones that stop treating a zero-day as a rare, high-severity event requiring a special response, and start treating it as a standing condition their architecture is already built to withstand, the same way a well-run system doesn't panic every time it sees a phishing email, because it was never designed to depend on phishing emails being rare.

If discovering the crack in your armor is no longer expensive, rare, or the province of a few sophisticated actors, the only durable answer is to stop having cracks that matter. Everything else is just hoping today isn't the day someone with a grudge and a laptop decides to try.