"That's Not a Zero-Day"

Jessy Lang: Welcome back to Security Dialogues. I'm Jessy, and this is episode four. It's back to just the two of them tonight, and Tess is bringing something Marcus is going to hate. This week, a report landed on Marcus's desk with "zero-day" in the subject line, addressed to a client he advises. By the end of the day he'd worked out it wasn't a vulnerability at all — and by the end of the week, he'd started wondering how many of the reports before that one hadn't been either.

Marcus Hale: It genuinely wasn't a vulnerability. A researcher had found that the free-tier project limit on this client's platform - five projects, printed right there on the pricing page - isn't technically enforced. You can create a sixth. A sixtieth, if you want to sit there and do it by hand.

Tess Calder: And he called that a "zero-day"?

Marcus Hale: "Zero-day: unauthorized resource access via broken tier enforcement." Full CVSS breakdown attached, like it was a privilege escalation. I read it twice to make sure I wasn't the one missing something.

Jessy Lang: Marcus, Tess ... I see, this is where tonight starts.

— I. Not Even a Vulnerability —

Tess Calder: Was there something you were missing?

Marcus Hale: No. I called the client before I wrote back to him. Turns out nobody ever built the hard limit, and it wasn't an oversight - it was a decision, made years ago, that they've never revisited because it still works. Cap people at exactly five projects and lock the door, and you teach your entire free tier one lesson: open a second account, and a third, and you've handed them a permanent way around you. Leave it soft, let someone quietly run eleven projects on a five-project plan, and eventually somebody on the sales side calls them and says, you're clearly getting real value out of this. Do you want to talk about a plan that actually fits what you're doing?

Tess Calder: So the "vulnerability" actually is a sales funnel? One with a long memory?

Marcus Hale: The "vulnerability" is a sales funnel that's been converting free users for several years. I wrote back, thanked him for the report, and explained, as gently as I could manage, that nothing was broken - the behaviour was intentional and the client had no interest in changing it. He resubmitted the same report to a public vulnerability tracker anyway, still labelled zero-day, still with the CVSS score attached. It's sitting there now with an identifier. Somebody will cite it in a scan someday.

Tess Calder: Which is the part that should worry you more than the report itself did.

Marcus Hale: It's the part I keep coming back to, yes. He didn't get the finding wrong so much as he never checked whether there was a finding at all before reaching for the loudest word available.

— II. What the Word Actually Means —

Marcus Hale: Fine. Let's do this properly, because I genuinely don't think most people who use the word could define it if you stopped them and asked. A zero-day is a vulnerability that's being exploited before the vendor has had any opportunity to fix it. ... Before the vendor even knows it exists. Zero days of lead time between discovery and exploitation. ... That's the entire claim. It's a statement about a timestamp: did exploitation start before the vendor could plausibly have known? Or after.

Tess Calder: It's not a statement about how bad it is.

Marcus Hale: It says nothing whatsoever about how bad it is. A zero-day can be catastrophic, or it can be a rounding error nobody ever exploits twice. The word doesn't carry severity - it was never built to carry severity. It only ever answered one question, and it's not the question everyone thinks it answers.

Tess Calder: Which makes what happened to you this week almost funny, in a bleak way. He didn't even clear the first bar. Nothing was exploited, because nothing was ever exploitable - there was no vulnerability sitting there waiting for a timestamp. He skipped straight past "is this even a finding" to "how do I phrase this so it sounds like the worst kind of finding there is."

Marcus Hale: And it worked, in the sense that it landed on my desk marked urgent and I dropped what I was doing to read it.

Tess Calder: That's not the word working. That's the word doing exactly what it was designed to do by someone who'd noticed it works on people like you.

— III. What One Actually Looks Like From the Inside —

Marcus Hale: Since you're the one in the room who's actually found one - say what it looked like. Not the write-up. The actual moment.

Tess Calder: It wasn't a moment. That's the first thing people get wrong. Four years ago, authorised engagement, a medical device manufacturer. I spent eleven days on one piece of embedded firmware before I found anything, and what I found wasn't dramatic to look at ... a bounds check that assumed a field could never exceed a length it absolutely could exceed, if you built the packet by hand instead of through the vendor's own tooling. No public disclosure existed. No CVE. The vendor had no idea. That's the entire definition satisfied, and the whole thing happened at a desk, over eleven quiet days, with three false starts I never wrote up because they went nowhere.

Marcus Hale: No breathless anything.

Tess Calder: I filed a report with a severity rating, a proof of concept, and a disclosure timeline, and I waited ninety days like the agreement said, and the vendor patched it, and almost nobody outside that room ever heard about it. That's what a real one is. It's eleven boring days and then a paragraph nobody reads. The version that gets a headline and a conference slot is almost never the same event as the one that actually meets the definition.

Marcus Hale: So even the genuine article doesn't look like what the word has come to signal.

Tess Calder: Least dramatic thing I've ever gotten paid for. Which is correct, and which is exactly why nobody markets it that way.

— IV. The Wrong Timestamp —

Tess Calder: Now compare that to the one that actually costs people real money, and takes a lot longer than eleven days to notice went wrong. Eighteen months ago a researcher publishes a technique against a class of authentication libraries - solid work, real finding. Vendors patch within weeks. Advisories go out, CVEs get assigned, everyone moves on. Six months ago, someone runs the identical technique against a target that never applied the patch, gets in cleanly, and writes it up as a fresh discovery. Zero-day, breathless write-up, a conference slot booked off the back of it.

Marcus Hale: It's not a zero-day. It's an eighteen-month-old, fully documented N-day that somebody's patch cycle never caught, dressed up as something nobody could have seen coming.

Tess Calder: Right, but "I found an eighteen-month-old N-day nobody patched" doesn't get you a conference slot. "Zero-day" does. So the technique gets relabelled on the way out the door, and the actual story - a real bug, a real fix that existed the whole time, a real gap in somebody's patch management sitting open for a year and a half - gets buried under a word that implies nobody could have prevented it. Everyone could have prevented it. It had a CVE number and a fix before the exploit ever ran.

Marcus Hale: I recognise that one from the other direction, and it stings worse from there. I've written advisories where I knew the honest headline was "this has been exploitable since March and the affected party never updated," and I've watched a journalist turn it into "newly discovered zero-day threatens thousands" anyway, because that's the sentence that gets published and shared, not the one that's accurate.

Tess Calder: Did you ever correct one?

Marcus Hale: Once. It cost me an afternoon and the correction got a tenth of the readers the original story did. I stopped trying after that, which I'm not proud of either.

— V. A Real One, and It Shouldn't Have Mattered to Most People —

Marcus Hale: Here's the one that's actually a zero-day, correctly labelled by every definition I just gave you, and still tells you almost nothing useful about what to do. Two years ago, a genuine zero-day landed in a logging library most of the industry had never heard of before that week. Exploited in the wild before anyone had a patch — textbook, no argument from me, no relabelling involved. And it affected perhaps forty organisations worldwide, all running one specific integration almost nobody else used.

Tess Calder: But it was a real zero-day, so it led every feed for a week regardless.

Marcus Hale: It led every feed for a week, and I had three separate clients call me in a genuine panic who weren't even running the affected integration — they'd read the vendor name in the headline and assumed the worst. I spent more hours that week explaining why a correctly labelled, entirely real zero-day didn't apply to them than I spent on the one client who actually had exposure and needed help.

Tess Calder: So the label was accurate and still nearly useless, because it answered a question nobody actually needed answered. Everyone wanted to know "should I be scared right now," and the word "zero-day" cannot answer that question by itself. Only the actual exposure can, and exposure takes longer than a headline to establish.

Marcus Hale: Which means even when the word is used correctly, it's doing the wrong job. It's timing information being read as a severity signal by an audience that was never told the difference.

Tess Calder: What happened with the one client who actually had it?

Marcus Hale: Quietest week of the four. They isolated the integration within an hour of the advisory, because they already had it mapped as a dependency and knew exactly where it touched their environment. No panic call, no all-hands. They didn't need the word to tell them how scared to be — they already knew what that library could reach, because somebody had written it down before there was ever a reason to.

Tess Calder: So the one org that had genuine exposure was the calmest one on the call, and the three that had none were the ones setting off alarms.

Marcus Hale: Which should tell you something about what the word is actually correlated with. Not risk. Just attention.

— VI. The Boy Who Cried Zero-Day —

Tess Calder: And here's what that actually costs you, from where I sit. I've run engagements where the target's own security team told me, almost with some pride, that they don't chase every "zero-day" alert that comes through their feeds anymore — because ninety percent of the ones they chased last year turned out to be nothing, exactly like your rate-limit report. That is a completely rational conclusion to draw from two years of mostly-noise alerts. And it is exactly the condition I most want to walk into on an engagement.

Marcus Hale: Because the one time in ten it's real, you're already past the point where anyone's watching closely.

Tess Calder: I don't even have to be clever about it. I just have to be the tenth alert of the month. Nobody staffs for the tenth alert once the first nine have wasted their week.

Marcus Hale: You're describing attackers relying on our own fatigue as infrastructure.

Tess Calder: I'm describing attackers relying on a word your side of the industry drained of meaning faster than mine could ever have exploited it on its own. I didn't do that to the word. Marketing did that to the word, and I just happen to benefit from the wreckage.

— VII. Who's Selling the Panic —

Marcus Hale: Say the rest of that, because I think you're about to, and I think you're right to.

Tess Calder: Start with the individual incentive, because it's the honest one. A bug bounty program will pay out a few hundred dollars for "broken tier enforcement, business logic, low severity" — assuming they pay it out at all, since plenty of programs exclude business-logic reports entirely. The same finding, filed as "zero-day: unauthorized resource access," sometimes gets triaged by someone in a hurry before anyone downgrades it, and even when it does get downgraded, the researcher's already got the word in the public writeup, the CVE, and the conference submission. Worst case for them, somebody argues about severity later. Best case, nobody bothers checking and it just sits there labelled.

Marcus Hale: Which means the incentive to overclaim is one-directional. There's no symmetric penalty for calling a sales funnel a zero-day. Nobody loses their CVE-assignment privileges over it.

Tess Calder: There's a whole layer above the individual incentive that isn't researchers at all, misguided or otherwise. Threat-intel vendors running a "zero-day of the month" newsletter. A public leaderboard nobody asked for, ranking vulnerabilities by drama instead of by exploitability. Push alerts timed for maximum forward-shares on a Monday morning. None of that is measuring anything real. It's a subscription product, and fear is what renews the subscription every quarter. The bar for what gets to wear the word keeps dropping, because a quiet month is bad for engagement, and a newsletter that says "nothing much happened" doesn't get opened.

Marcus Hale: It's the identical instinct that's put "AI-powered" on every appliance at every vendor booth I walked past this year — half of which turned out to be a lookup table with a better marketing slide behind it. Same move exactly: borrow the word that reliably gets attention, spend none of the actual effort the word implies you spent.

Tess Calder: A zero-day newsletter and an "AI-powered" firewall sticker are functionally the same product, sold to the same fear. Neither one is describing what's actually inside the box. Both are describing what they want you to feel before you've had a chance to check.

Marcus Hale: …And I've personally paid for both, at different points in my career, before I'd learned to ask what was actually inside. Not proud of either purchase.

Tess Calder: I don't hold it against you. I nearly bought a "threat intelligence" feed once that turned out to be somebody's Twitter scraper with an invoice attached.

— VIII. The Clock That Doesn't Care What You Call It —

Marcus Hale: There's a version of this that isn't just wasted attention anymore, and I want to put it on the table because it's the one that keeps me up. Under the Cyber Resilience Act, once we know a product is being actively exploited, the clock on notifying ENISA and the national CSIRT starts at twenty-four hours. Not twenty-four hours from when someone confirms it's a real, catastrophic, headline-worthy incident. Twenty-four hours from when we know it's being actively exploited, full stop, whatever the eventual severity turns out to be.

Tess Calder: So the label problem stops being an annoyance and becomes a compliance problem in both directions at once.

Marcus Hale: In both directions at once, exactly. If I take every "zero-day" report at face value because the subject line said so, I'm burning my team's attention on the clock for things that were never actively exploited at all — a report like this week's shouldn't start any clock, because nothing was being exploited, because nothing was exploitable. But if I've spent two years getting jumpy from noise and I wave through a report that says "zero-day" out of habit without actually checking whether exploitation is real, and it turns out this one was genuine, I've potentially blown a regulatory deadline because I'd stopped reading past the subject line.

Tess Calder: The clock doesn't know you were tired. It doesn't know the last nine alerts were nothing.

Marcus Hale: It doesn't care. Which means the triage step — actually confirming whether something is exploitable and whether it's being exploited, before any label gets attached to it — isn't optional housekeeping anymore. It's the only thing standing between us and either wasting a regulator's time with noise, or missing a legal deadline because we'd learned to stop taking the word seriously.

Tess Calder: That's a sharper version of what I do on every engagement, honestly. I don't get to say "probably nothing" and move on. I have to actually establish whether a path is real before I write it down, because someone downstream is going to make a decision, sometimes a regulatory one, off exactly what I wrote.

— IX. What Actually Works —

Marcus Hale: Here's what I keep coming back to, and it's not glamorous, and it will not sell a single newsletter subscription. The client whose "zero-day" I closed out this week — that same client had a SARIF report land on my desk eight months earlier. Unglamorous static-analysis output, forty-odd findings, zero drama in any line of it. We ran the whole set through an actual threat model, ranked which findings could actually reach something that mattered to their business, funded three fixes, and explicitly deferred the rest with a name and a reason attached to each deferral. Boring paperwork, every step of it. Nobody has ever asked me to give a talk about it.

Tess Calder: And?

Marcus Hale: And that's the client who wasn't in a panic this week, because the thing that could actually have hurt them had already been found, argued about, and closed eight months earlier, by people doing unglamorous work at a desk with no audience. The zero-day report that came in Monday was noise precisely because the real work was already finished.

Tess Calder: That matches what I see from the attacking side, almost exactly, and I want to give you the mirror image so you don't think this is just a PSIRT story. The targets that are genuinely hard aren't the ones running the newest detection product or subscribed to the loudest feed. They're the ones where someone sat down, before I ever showed up, and asked which of their assets losing confidentiality, integrity, or availability would actually ruin their week — and then spent the budget defending those, instead of spreading it thin across everything at once. I had an engagement last year against a company half the size of one I'd broken into a month before, and it took me three times as long, because they'd clearly done that exercise and the other company clearly hadn't.

Marcus Hale: What was different, concretely?

Tess Calder: Segmentation that actually matched where their crown jewels were, not where the org chart said the network team should draw a line. Credentials that expired on a schedule someone had actually thought about. And when I did find a way in, the blast radius was exactly one system, because somebody had already asked "what happens if this one gets popped" and built the answer in advance, instead of discovering it live with me inside it.

Marcus Hale: So the alarm was never the thing keeping either of your companies safe.

Tess Calder: The alarm was never the thing. It's what got done on every quiet day before the alarm that decided what happened on the one loud day. I can't find a zero-day fast enough to beat an organisation that already knows where it actually bleeds and has put a real control in front of it.

Marcus Hale: And it's the same work that answers the CRA clock question before the clock ever starts. If you already know what a component touches and what it can reach, "is this being actively exploited, and does it matter" is a fast, confident answer instead of a forty-minute scramble through documentation nobody kept up to date. The threat model isn't a compliance artefact I file away. It's the thing that makes the compliance deadline survivable.

Tess Calder: Boring, upfront, and it pays out exactly when everything else is on fire. I'd take that trade every time.

— X. Manufactured Urgency —

Marcus Hale: Then let's name it properly, because I think we've been circling the same word from two different sides all night without quite landing on it. Call it manufactured urgency — urgency generated by a label, a leaderboard, a newsletter, a sticker on a box, entirely disconnected from whether there's a real exposure sitting underneath it. It sells subscriptions. It sells appliances. And every so often it sells an entire security team's week to a bug that was never a bug at all.

Tess Calder: And the thing that actually beats manufactured urgency isn't a sharper alarm, or a faster feed, or a better dashboard. It's never needing to hear the alarm in the first place, because the work that would have told you what mattered already happened — the threat model that ranked the real risks, the control that was already sitting in front of the thing that actually matters, before anyone came looking for a way in. Rehearsed calm, not faster panic.

Marcus Hale: I'll take rehearsed calm. It's a considerably better use of a Tuesday than the one I actually had.

Tess Calder: You closed a fake zero-day by lunch. That's not nothing, as Tuesdays go.

Marcus Hale: I closed a fake one by lunch and spent the rest of the afternoon wondering how many real ones I've missed while a false one had my attention. I'd rather spend next Tuesday on the boring work that makes that question stop mattering, before it needs a headline to get mine.

— Outro —

Jessy Lang: Manufactured urgency versus rehearsed calm. I like that one of those has a marketing budget behind it and the other one has a Tuesday afternoon and a threat model nobody's ever going to put on a conference slide. If you've ever had to explain to your own team why a "zero-day" in your inbox wasn't one — or why it genuinely was, and it still didn't matter — tell us. We read everything. Subscribe wherever you're listening to this, and leave us a rating if a rate-limit bug bounty report has ever ruined your Tuesday for absolutely no reason. Next time, we're pulling on a thread neither of them has touched yet: what happens to all of this when the vulnerability isn't in code either of them wrote, but in a component nobody's heard of, three suppliers deep in something that shipped five years ago. Until then.