Zero-day response is not incident response with a different name — it runs on a compressed clock because there is no patch yet, and the fix has to work against an unknown exploit chain. This guide breaks the process into the five stages that actually hold up under pressure: detect, triage, contain, remediate, verify, and review.
- A zero day vulnerability response process runs five stages: detect, triage, contain, remediate, verify, review — in that order, every time.
- CVSS 9.0-10.0 marks Critical severity, but exploitability data (EPSS, CISA KEV) decides real urgency, not the CVSS score alone.
- CISA's Known Exploited Vulnerabilities catalog gives federal agencies as little as two weeks to patch once a CVE is added — a useful benchmark for private-sector SLAs too.
- Containment (isolate, virtual-patch, restrict access) buys time between disclosure and a real fix — most teams skip this step and pay for it.
- Brinqa's exposure management platform pulls scanner, EPSS, and threat-intel data into one prioritization view so triage doesn't happen in five separate tabs.
Why this matters
A zero-day is a vulnerability being exploited, or exploitable, before a vendor patch exists. That single fact breaks the normal vulnerability management rhythm — scan, ticket, patch on the next cycle — because there's no patch to schedule.
Teams that treat zero-day response as "the same process, faster" burn hours re-discovering which assets are exposed while the exploit is already active. Teams with a documented process built for automated CVE triage at scale skip that step entirely because the asset-to-vulnerability mapping already exists before the alert fires.
In 2026, the gap between disclosure and mass exploitation keeps shrinking — CISA's KEV catalog regularly adds CVEs within days of public proof-of-concept code appearing. A response process built for 2020-era patch cycles doesn't hold in 2026.
The zero-day vulnerability response process, step by step
1. Detect and validate
Confirm the CVE applies to your environment before anything else moves. Cross-reference the affected product, version range, and configuration against your asset inventory — a CVE announcement without asset matching is just noise with a number attached.
2. Triage by exploitability and exposure
CVSS tells you severity in a vacuum; it does not tell you what's actually being exploited. Pull the EPSS score (a 0-1 probability of exploitation in the next 30 days, published by FIRST.org) alongside CISA's KEV listing status, then rank by asset criticality and internet exposure — not by CVSS alone. This is the step most vulnerability management for lean security teams processes get wrong: they patch in CVSS order and miss the CVE with a 7.5 score that's already in EPSS scoring's top exploitation percentile.
3. Contain
Before a permanent fix exists, contain the blast radius: isolate exposed assets, apply a virtual patch through your WAF or EDR, restrict network access, or disable the vulnerable feature if the vendor offers a workaround. Containment is the step that separates a controlled response from a scramble — it buys the hours or days needed for step four.
4. Remediate
Apply the vendor patch, a configuration change, or a compensating control the moment one is available, prioritized against remediation SLAs by severity rather than a blanket 30-day cycle. A zero-day actively listed in CISA's KEV catalog should move to the front of every queue regardless of what else is scheduled that week.
5. Verify
Re-scan and confirm the fix actually closed the exposure — patches fail to apply, configuration changes get reverted, and compensating controls sometimes only cover part of the attack surface. Skipping verification is how a "resolved" ticket turns into a repeat incident three weeks later.
6. Review
Run a short post-incident review: how long from disclosure to detection, detection to containment, containment to remediation. Feed those numbers back into the next zero-day playbook instead of filing the incident report and moving on.
Why zero-day response timelines vary
- Exploit availability — a CVE with public proof-of-concept code moves faster through triage than one with a theoretical exploit path.
- Asset exposure — internet-facing systems get contained first; internal-only assets can wait a step behind.
- Vendor patch timeline — some vendors ship a fix in hours, others take weeks, which changes how long containment has to hold.
- Regulatory obligations — sectors under HIPAA, FedRAMP, or CMMC often carry stricter internal deadlines than the general SLA.
- Staffing and on-call coverage — a zero-day disclosed on a Friday night moves at a different speed than one disclosed on a Tuesday morning.
- Data quality — response stalls when scanner, CMDB, and threat-intel data live in separate systems that don't correlate threat intelligence with vulnerability data automatically.
The teams that respond fastest in 2026 aren't the ones with the biggest security budgets — they're the ones whose asset inventory and vulnerability data already talk to each other before the CVE drops.
See exposure management in action
Unify scanner, EPSS, and threat-intel data into one prioritization view.
Related questions
What's the difference between zero-day response and regular vulnerability management?
Zero-day response happens before a patch exists, so containment replaces patching as the first move; regular vulnerability management assumes a fix is already available and schedules it against a standard SLA. The two processes share the same asset and prioritization data — they just run on different clocks.
How fast should you patch a zero-day being exploited in the wild?
As fast as containment allows, with CISA's KEV catalog setting a public benchmark: federal civilian agencies get as little as two weeks once a CVE is listed, and private-sector teams increasingly use that same window as an internal target. Assets that are internet-facing or hold sensitive data should move faster than that baseline, not slower.
Who owns the zero-day response process — SecOps or IT?
Ownership splits by stage: SecOps typically owns detection, triage, and containment, while IT operations owns the actual patch or configuration change during remediation. The handoff between those two teams is where most zero-day processes lose time, which is why a shared asset-and-vulnerability view matters more than which team "owns" the ticket.
FAQ
What is a zero-day vulnerability response process?
A zero day vulnerability response process is a five-stage workflow — detect, triage, contain, remediate, verify — built to handle vulnerabilities that have no vendor patch yet. It differs from standard vulnerability management by prioritizing containment over patch scheduling.
How is a zero-day different from a regular vulnerability?
A zero-day is exploited or exploitable before a fix exists, while a regular vulnerability already has a patch available. That difference is why zero-day response leads with containment instead of jumping straight to remediation.
What CVSS score counts as a zero-day emergency?
CVSS 9.0-10.0 marks Critical severity, but a lower-scored CVE with active exploitation in CISA's KEV catalog or a high EPSS score should still be treated as an emergency. Severity score alone misses real-world exploitation signals.
How long does CISA give agencies to patch a zero-day?
CISA's Known Exploited Vulnerabilities catalog assigns remediation deadlines as short as two weeks for CVEs added since 2021, binding on federal civilian agencies. Private-sector teams use the same catalog as an exploitation signal even without the binding deadline.
What is EPSS scoring and how does it help zero-day triage?
EPSS produces a 0-1 probability score estimating how likely a vulnerability is to be exploited in the next 30 days, published by FIRST.org. It's used alongside CVSS to separate high-severity CVEs that are actually being exploited from ones that are only theoretically dangerous.
Can you contain a zero-day before a patch is released?
Yes — containment options include isolating exposed assets, applying a virtual patch through a WAF or EDR, restricting network access, or disabling the vulnerable feature entirely. Containment is meant to hold the line until remediation is possible, not replace it.
Does a zero-day response process need a separate playbook from normal patching?
Yes — a zero-day playbook needs a containment stage and faster escalation paths that a standard 30-day patch cycle doesn't require. Reusing the same asset and exposure data across both playbooks avoids rebuilding prioritization logic from scratch each time.
Who should own zero-day remediation SLAs?
SecOps typically sets the SLA and owns triage through containment, while IT operations executes the patch or configuration change during remediation. Clear severity-based SLAs, set before the next zero-day drops, prevent the ownership question from stalling response mid-incident.
One last thing
Most zero-day exploitation starts before the CVE is even public — CISA typically adds a CVE to the KEV catalog only after exploitation is already confirmed, which means your response process is reactive by design no matter how fast your team moves. The teams that close the gap fastest in 2026 aren't reacting to the CVE announcement; they're reacting to exposure signals — EPSS shifts, exploit chatter, unusual scan activity — that show up before the formal listing does. Brinqa's exposure management platform is built around that earlier signal, correlating asset, vulnerability, and threat-intel data continuously instead of waiting for the next scan cycle.
