Zero-Day & Vulnerability Weaponization

Zero-day vulnerabilities — software flaws unknown to the vendor and therefore unpatched — represent the highest-value commodity in both the state intelligence and criminal cyber ecosystems. A reliable zero-click iOS exploit is worth $2–5 million on the grey market. The window between discovery and vendor patch defines the danger period; the window between patch release and enterprise deployment defines the opportunity that criminal and state actors exploit most commonly.

The weaponization of vulnerabilities occurs across a spectrum: nation-state intelligence agencies develop and hoard zero-days for exclusive use; exploit brokers like Zerodium and Crowdfense purchase and resell to government clients; criminal groups purchase or independently discover vulnerabilities for ransomware and financial fraud; and the n-day ecosystem — exploiting recently patched but undeployed fixes — is the most common attack vector across the entire threat landscape.

The debate over 'Vulnerabilities Equities Process' — whether governments should hoard or disclose zero-days — remains unresolved, with EternalBlue (leaked from the NSA and used in WannaCry and NotPetya) as the canonical example of the catastrophic downside of stockpiling undisclosed vulnerabilities.