What is a zero-day vulnerability?

You've probably seen the term in the news. Here's what it means in plain English, some real examples, and the few things a small business should actually do about it.

What "zero-day" means

A zero-day is a security flaw in software or a device that attackers find and start using before the company that makes it has a fix. The name comes from the maker having had "zero days" to fix it.

You'll see three related terms. The vulnerability is the flaw itself. The exploit is the code or trick that uses it. The attack is when it's used against someone. Once a fix is released, it's no longer strictly a zero-day. Anyone who hasn't installed the fix is still exposed, though, and that's where most small businesses get caught.

Real examples you may have heard of

• MOVEit (2023). A ransomware gang used a zero-day in MOVEit Transfer, a file-sharing tool, to steal data. The payroll provider Zellis was hit, and through it, staff details from the BBC, British Airways and Boots were taken, even though none of those three were hacked directly. Lesson: your suppliers' software is part of your risk.
• Log4j, or "Log4Shell" (December 2021). This was a flaw in a small logging component hidden inside thousands of products. The NCSC called it potentially the most severe computer vulnerability in years, and many organisations didn't even know they used it. Lesson: know what you run, and follow your suppliers' advice.
• Kaseya (2021). Criminals used a zero-day in remote-management software used by IT support companies. They pushed ransomware to those companies and on to their small-business customers. Lesson: ask your IT provider how they protect their own tools.
• Everyday updates (2026). Microsoft's February 2026 update fixed six zero-days that attackers were already using, and Google has had to rush out several emergency Chrome fixes this year. Lesson: the updates on your laptop and browser really matter.

Why it matters for a small business

Brand-new zero-days are valuable, so attackers often use them against big targets first. The danger for small firms usually comes next. Once a flaw is public, criminals use automated tools to scan the whole internet for anyone who hasn't installed the fix. Being small doesn't protect you; being unpatched makes you a target.

What to do when a zero-day is in the news

1. Check whether you use it. Is the product in your business? Think laptops, phones, browsers, your router, your website platform, or a service a supplier runs for you.
2. Install the fix as soon as it's out. Don't wait for your usual update day. If there's no fix yet, follow the maker's temporary advice.
3. Ask your IT provider and key suppliers. A short email asking "Are we affected, and what have you done about it?" is reasonable and expected.
4. Check official advice. The NCSC publishes alerts and guidance for UK organisations at ncsc.gov.uk.
5. If you think you've been hit, report it to the NCSC at report.ncsc.gov.uk, and get expert help quickly.

Habits that limit the damage

You can't stop a flaw nobody knows about yet, but you can make it far less likely to hurt you:

• Turn on automatic updates for every device, browser and app.
• Use multi-factor login on email and cloud accounts.
• Keep admin accounts separate from the ones you use every day.
• Replace devices and software that no longer get security updates.
• Keep backups, including one stored separately, and check that you can restore from them.
• Keep a simple list of the devices, software and key suppliers you use, so you can check quickly when news breaks.

How this connects to Cyber Essentials

Cyber Essentials is built around exactly these habits. It requires critical and high-risk updates within 14 days, multi-factor login on cloud services, the removal of unsupported software, controlled admin accounts and malware protection. It won't make you immune to a zero-day, but it closes the gaps attackers rely on once a flaw becomes public.