Zero-day exploit
An attack that uses a vulnerability the software vendor does not yet know about, so no patch exists yet. Rare in practice for small business servers compared to n-day exploits.
Why patching alone cannot stop this category
By definition, no patch exists yet for a zero-day vulnerability, since the vendor does not know about it. This is exactly why layered defenses such as a WAF, intrusion prevention, and least-privilege configuration matter even on a fully patched server.
What actually reduces the risk
Reducing the attack surface, running services with minimal privileges, and having monitoring in place to detect unusual behavior quickly all help limit the damage from a zero-day, even though none of them can prevent the vulnerability from existing in the first place.
Frequently asked questions
How common are zero-day attacks against small businesses specifically?
Less common than exploits against already-known, unpatched vulnerabilities, since zero-days are comparatively rare and often reserved for higher-value targets, but they are not impossible.
Does a fully patched server mean I am safe from zero-days?
No, since a zero-day exploit targets a vulnerability nobody has patched yet, by definition. Patching protects against known issues, which is still the vast majority of real-world attacks.
What happens once a zero-day becomes publicly known?
It typically becomes an n-day exploit, meaning a patch usually follows soon after, and the priority shifts to applying that patch as quickly as possible before attackers who reverse-engineer it can act.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab