Many cybersecurity leaders are dealing with a difficult problem known as zero-day vulnerability, particularly after the Log4j and SolarWinds incidents. It's important to understand what zero-day vulnerability is and how it relates to third-party risk management.

A zero day (also referred to as 0-day) is a software vulnerability either unknown to its developer, or known and without a patch to fix it. The name comes from the fact that the vendor has “zero days” to fix before it is actively exploited.

Attackers can exploit the vulnerability to compromise data, systems, and devices, including operating systems, web browsers, office applications, open-source components, hardware, firmware, and IoT devices.

Understanding the terms vulnerability, exploit, and attack can be a bit confusing. However, it's crucial to know the difference between these terms:

• Zero-day vulnerability is a flaw in software that attackers discover before the vendor does. Since there is no patch available yet, attacks using this vulnerability are more likely to be successful. On the other hand;

• Zero-day exploit is the code that attackers use to exploit the vulnerable software and compromise systems. These exploits are typically sold on the dark web;

• Zero-day attack happens when a zero-day exploit is used to disrupt, cause damage to, or steal data from a vulnerable system.