🔑 Key Insights (2025 Snapshot)
- Enterprises remain highly exposed due to slow patching cycles and incomplete visibility.
- 75 zero-day vulnerabilities discovered in 2024, showing a continued upward trend.
- 44% of these zero-days targeted enterprise systems, especially security and networking tech.
- AI has begun discovering and weaponizing vulnerabilities autonomously.
One of the most dreaded cybersecurity threats is zero-day vulnerabilities. Attackers take advantage of these vulnerabilities before vendors are made aware of them or issue a patch, leaving defenders with no time to get ready. The stakes are higher than ever in 2025. As AI speeds up discovery and exploitation and nation-state actors target enterprise technologies, CISOs need to reconsider how they assess and get ready for zero-day threats.
The Zero-Day Landscape: Key Statistics
Google’s Threat Analysis Group reports that 75 zero-day exploits were found in 2024, which is much more than the 63 found in 2022 but slightly less than the 98 found in 2023. Even though the volume somewhat dropped, enterprise systems became the primary target of these attacks:
- 44% of 2024 zero-days targeted enterprise technologies, up from 37% in 2023.
- Over 60% of enterprise-targeted zero-days affected security and networking products, including firewalls, load balancers, and identity providers.
This information highlights a strategic shift by threat actors, who are now entering enterprise infrastructure, where visibility is lower and the stakes are higher, rather than hardened user platforms.
Live Vulnerability Exploits in 2025: Case Studies
ToolShell in SharePoint (CVE-2025-53770 & 53771): It was confirmed in Q2 2025 that Chinese APT groups had compromised assets belonging to the U.S. Department of Energy (DOE) and more than 50 other organisations by taking advantage of these vulnerabilities. Attackers were able to create persistent backdoors in cloud-connected SharePoint environments thanks to these zero-day vulnerabilities.
EchoLeak in Microsoft 365 Copilot (CVE-2025-32711): A zero-click flaw that could allow sensitive prompts and context information to be silently extracted from enterprise Copilot deployments. Even though it was quickly fixed, its discovery forced urgent reviews of all AI-integrated systems.
Windows WebDAV & SMB Stack (CVE-2025-33053 & 33073): These flaws, which were used in targeted attacks against the defence and government sectors, brought attention to the dangers of exposed outdated and improperly configured protocols.
AI and Zero-Day Discovery: A New Frontier
By 2025, artificial intelligence (AI) tools are not only protecting networks but also identifying weaknesses. UC Berkeley researchers showed how autonomous agents could find previously unidentified bugs in more than 188 open-source projects, leading to 15 verified zero-day vulnerabilities.
Threat actors, meanwhile, have adopted AI to speed up exploitation and scanning. TechRadar reports that AI-enhanced reconnaissance and vulnerability chaining are to blame for the recent spike in global scan rates, which now stand at 36,000 per second.
| Metric | 2022 | 2023 | 2024 | 2025 (est.) |
| AI-Discovered Zero-Days | 1 | 4 | 9 | 15+ |
| Automated Scan Rate/sec | 5K | 12K | 20K | 36K |
What CISOs Must Do: Actionable Strategies
To stay ahead of zero-day threats, CISOs need to go beyond patching:
- Prioritize Critical Patch Management: Monitor the CISA Known Exploited Vulnerabilities (KEV) catalog and apply emergency patches within hours, not days.
- Invest in Threat-Informed Red Teaming: Simulate adversary TTPs that resemble actual zero-day exploitation chains.
- Enhance Detection and Response: To find anomalies even in the absence of known indicators, use cloud telemetry, behavior-based detection, and endpoint visibility.
- AI-Augmented Defense: Use anomaly detection and AI-driven code scanners to find questionable changes in runtime environments.
Why Bluefire Redteam?
Our area of expertise at Bluefire Redteam is adversary emulation, which includes creating unique simulations of ransomware and nation-state actors’ zero-day strategies.
- Use threat intelligence and cutting-edge tools to replicate actual zero-day chains.
- Assist CISOs in verifying their defence strategy against unidentified dangers.
- Provide remediation plans for high-sensitivity environments after operations.
In a world where zero-day threats evolve daily, our team ensures your organization isn’t just reactive, but proactively resilient.
Final Thoughts: Preparing for Tomorrow
Zero-day attacks are now operational realities rather than merely theoretical threats. Because AI is accelerating discovery and attackers are focussing on enterprise technology, CISOs need to adopt a proactive, threat-informed approach.
Are you prepared to test your defences against a zero-day attack simulation? Take the first step towards real resilience by learning more about Bluefire Redteam Services.