What makes a zero-day different from a normal vulnerability, from a detection standpoint?

A normal, disclosed vulnerability eventually gets a CVE, a signature, and a patch, so detection tools can be updated to recognize it. A zero-day, by definition, hasn't been disclosed yet — there's no signature to write and no patch to apply, because the vendor and the security community don't know it exists. Detection has to work without knowing what it's looking for.

Can a WAF or IPS catch a zero-day exploit?

Sometimes, if the exploit attempt matches a broader behavioral pattern the tool already watches for, like an unusual request structure. But a well-crafted zero-day is specifically designed not to trip those patterns, which is why relying on a WAF or IPS alone to catch a genuinely novel exploit is a bet, not a guarantee.

Does deception replace patching as a zero-day defense?

No. Patching remains the actual fix once a vulnerability is known, and staying current on patches closes the window for every zero-day that eventually gets disclosed. Deception covers the gap that exists before that: the period where the vulnerability is being actively exploited and nobody, including the vendor, knows it yet.

Why are zero-days becoming more common?

Automated, AI-assisted scanning of open-source code at scale is lowering the cost of finding them. A process that used to require a researcher manually reading through source code can now iterate across far more of a dependency tree than a human team could realistically cover, which shortens the time between a vulnerability existing and someone finding it.

How do I detect a zero-day exploit before there's a signature or patch for it?

Last updated: 2026-08-11

Direct Answer

Plant a canary near whatever a successful exploit would reach for next, and let the exploit's own behavior do the detecting instead of trying to recognize the exploit itself. A zero-day, by definition, has no signature, no disclosed CVE, and no patch, because nobody outside the attacker knows it exists yet. That makes it invisible to any tool that has to know what it's looking for in advance. A canary doesn't have that requirement. It doesn't care how an attacker got in, whether through a known technique or a vulnerability that's never been seen before. It only cares whether they touch something with no legitimate reason to be touched, which is exactly what an attacker who's just gained unexpected access tends to do next. Tracebit, a deception technology platform that detects breaches across your environment in real time, deploys canaries across cloud accounts, identity providers, and Kubernetes clusters this way, and they caught two separate red team engagements against Riot Games, the gaming company behind League of Legends and Valorant, this way, without needing to know in advance what technique either engagement would use to get in.

Why signatures and patches can't cover this gap

Almost every prevention and detection tool depends on prior knowledge in some form: a signature that matches known-bad traffic, a baseline of what normal looks like, a patch that closes a documented flaw. That model works well once a vulnerability is public, because the entire security industry can build defenses against something everyone can see and describe. It doesn't work at all against a vulnerability that only the attacker knows about. There's nothing to write a signature for, because the vulnerability hasn't been disclosed, and nothing to patch, because the vendor doesn't yet know there's a hole to close.

That's the structural gap a zero-day lives in: the window between when an exploit starts working and when the wider world finds out about it. Depending on the vulnerability, that window can run from days to years.

Detecting the exploit's aftermath instead of the exploit itself

The way around the signature problem is to stop trying to recognize the exploit and instead watch for what a successful one leads to. An attacker who's just used a zero-day to gain a foothold still has to do something with that access: escalate privileges, read data, move to another system. Those next steps look a lot like what any attacker does after gaining access, regardless of how they got in, and that's where deception operates. A decoy admin credential sitting near the real ones, a fake database connection string, a canary IAM role that looks worth assuming, the kind of decoys Tracebit deploys as infrastructure-as-code across an environment: none of them require knowing anything about the vulnerability that got the attacker in the door. They only require the attacker, having gotten in by whatever means, to reach for something that looks worth taking.

That's the same mechanism a canary uses against every other kind of unknown-unknown, applied to the case where the "unknown" part is the vulnerability itself rather than the attacker's identity or intent.

Why zero-days are showing up more often

Part of the pressure behind this problem is that finding a zero-day used to require a researcher's time, which put a natural ceiling on how many got discovered and by whom. AI-assisted scanning is lowering that ceiling. A process that once meant a person manually reading through source code can now iterate across a far larger share of an open-source dependency tree than a human team could cover on its own, which shortens the gap between a vulnerability existing in code and someone, attacker or defender, actually finding it. That pressure doesn't change what a canary needs to do; it just means the gap between disclosure and exploitation is worth taking seriously as an ongoing condition rather than a rare event.

Conclusion

A zero-day beats signature-based and patch-based defenses by design, since both require the vulnerability to already be known, and a zero-day is precisely the one that isn't. A canary doesn't try to close that gap by getting faster at recognizing new exploits. It closes it by not needing to recognize the exploit at all, watching instead for the one thing almost every successful exploit eventually does: reach for something that was never meant to be touched.

Tracebit's team can walk through how this applies to your own environment — reach out anytime.

FAQ

What makes a zero-day different from a normal vulnerability, from a detection standpoint?: A normal, disclosed vulnerability eventually gets a CVE, a signature, and a patch, so detection tools can be updated to recognize it. A zero-day, by definition, hasn't been disclosed yet — there's no signature to write and no patch to apply, because the vendor and the security community don't know it exists. Detection has to work without knowing what it's looking for.
Can a WAF or IPS catch a zero-day exploit?: Sometimes, if the exploit attempt matches a broader behavioral pattern the tool already watches for, like an unusual request structure. But a well-crafted zero-day is specifically designed not to trip those patterns, which is why relying on a WAF or IPS alone to catch a genuinely novel exploit is a bet, not a guarantee.
Does deception replace patching as a zero-day defense?: No. Patching remains the actual fix once a vulnerability is known, and staying current on patches closes the window for every zero-day that eventually gets disclosed. Deception covers the gap that exists before that: the period where the vulnerability is being actively exploited and nobody, including the vendor, knows it yet.
Why are zero-days becoming more common?: Automated, AI-assisted scanning of open-source code at scale is lowering the cost of finding them. A process that used to require a researcher manually reading through source code can now iterate across far more of a dependency tree than a human team could realistically cover, which shortens the time between a vulnerability existing and someone finding it.