The Zero-Day Panic is Missing the Point

AI could become frighteningly good at finding vulnerabilities, but that doesn’t mean cyber security is doomed! 

By now, we know that AI is capable of analysing millions of lines of code at extraordinary speed. It can spot subtle weaknesses human researchers missed, test possible routes of exploitation, and start uncovering zero-day vulnerabilities faster than security teams can patch them. That’s an uncomfortable prospect, yes – and if you follow some of the more apocalyptic predictions around AI and cyber security, the conclusion seems obvious:   

1. AI gets exceptionally good at finding vulnerabilities 
2. Vulnerabilities appear everywhere! 
3. Attackers exploit said vulnerabilities at machine speed and our digital defences crumble. 

There’s just one fairly significant problem with that logic …  

Finding the door is a long way from getting to the crown jewels. 

A zero-day isn’t a skeleton key 

Let’s be clear: an AI capable of discovering zero-days at unprecedented speed wouldn’t be “ideal”, to put it lightly. In cyber security a ‘zero-day’ is a previously unknown vulnerability for which a fix or patch isn’t yet available, potentially giving attackers an opportunity to exploit it before defenders can respond. If AI can enormously accelerate the discovery of these weaknesses, then it will shrink the window organisations have to react, allowing attackers to exploit weaknesses and establish a foothold before defenders have time to catch up. 

Still, finding a vulnerability is only one part of a successful attack. Threat actors still need a useful target, a viable route in, and an opportunity to turn that initial access into something more valuable. From there, they may need to escalate privileges, compromise identities with greater access, move laterally through the environment, establish persistence, and reach the systems or data they came for – all without being detected along the way. Our supposedly unstoppable AI hacker suddenly has quite a sizeable to-do list (and this, by the way, is exactly why privileged access management matters!). 

The distinction between finding a vulnerability and successfully compromising an organisation is important because good cyber security has never relied on every piece of software being completely invulnerable. If it did, we’d have been in trouble long before generative AI turned up. 

Remember, security works by creating layers of protection, visibility, and friction throughout an attack path. Meaning that a weakness in one place doesn’t automatically hand an attacker the keys to the organisation. Your network isn’t a medieval castle 

We still have a habit of talking about cyber security as though we’re defending a castle: build a very big wall, keep the attackers outside, and hope they never find a way through. Going by that model, discovering a hole in the wall does feel catastrophic. However, the good news is that modern digital environments are far more complex, and true resilience assumes that individual controls can sometimes be bypassed. 

To this end, I think an airport is probably a better comparison. Getting through one checkpoint doesn’t grant unrestricted access to every aircraft, baggage system, control room, and secure area. There are further checks, restricted zones, monitoring systems, identity controls, and people watching for behaviour that doesn’t belong. A resilient cyber environment works on much the same principle; putting multiple layers of protection, detection, and control between an attacker and the systems or data they ultimately want to reach.  

So, an attacker exploiting a zero-day might bypass one control or establish an initial foothold, but they still have plenty of work ahead of them. Identity security, endpoint detection, network segmentation, behavioural analytics, least-privilege controls, and the people monitoring what happens next can all create further barriers along the attack path. 

Focusing too heavily on zero-days risks putting all our attention on the moment an attacker gets in, when the strength of an organisation’s security depends on what happens throughout the rest of the journey too. Robust cyber security gives an attacker fewer opportunities to turn that initial foothold into something serious. Strong identity and access controls can restrict where they go next, segmentation can limit movement through the environment, and effective monitoring and detection can help expose suspicious activity before an attacker reaches critical systems or data. 

AI isn’t exclusively an attacker superpower 

There’s another oddity in the “AI cyber apocalypse narrative” too:  apparently, attackers get all the clever AI and defenders like us carry on exactly as they were.  

That seems unlikely. 

The same ability to analyse enormous amounts of information at speed can help defenders sift through security telemetry, identify suspicious behaviour, investigate threats, understand attack paths, and prioritise what requires human attention. 

We’re already seeing that principle inside security operations. Our own SOC combines AI-powered investigation and response capabilities with experienced analysts, using automation to accelerate triage and provide context to human analysts to pass judgement. This is important to remember because the AI cyber challenge isn’t simply spotting something, but also understanding whether that something matters, what it’s connected to, and what needs to happen next. Machine speed can be incredibly useful there. 

So yes, AI may help attackers move faster, but it also gives defenders greater visibility and helps them respond faster too. The AI arms race has two sides. 

Make the attacker’s life difficult 

This is where the conversation becomes much more practical. We can’t build a cyber strategy around the hope that nobody ever discovers another vulnerability because, AI or otherwise, that simply isn’t realistic.   

 Organisations can, however, make vulnerabilities considerably harder to turn into serious incidents by understanding where critical assets sit and who can access them, controlling privileges rather than allowing unnecessary permissions to accumulate, segmenting environments to restrict movement, and monitoring identity, endpoints and behaviour closely enough that suspicious activity produces a signal somebody can actually act upon.  

That also means accepting that prevention will always have limits and building security strategies with that reality in mind. After all, an organisation that assumes every defensive control will work perfectly only needs to be wrong once.   

Real business resilience means knowing how quickly you can spot something that gets through, how far an attacker could travel, what they could reach, how effectively you could contain them and – if damage is done – how confidently you could recover. As AI accelerates both attack and defence, those capabilities are even more important because the speed of the threat leaves less room for weak controls, excessive privilege, poor visibility, or a slow response. 

So, should we worry?? 

OK, yes. A little. 

There’s plenty here to take seriously. AI finding previously unknown vulnerabilities faster and at greater scale could change the economics of cyber-attacks, shortening the time defenders have to react, and increasing the pressure on organisations carrying technical debt, weak identity controls, or poor visibility across sprawling estates. That presents a serious security challenge, but predictions of the demise of cyber security are getting rather ahead of themselves! 

The more useful question is how well organisations can detect, contain, and recover when attackers are able to operate at machine speed. That requires security designed around resilience, with the ability to limit the damage an attacker can do, disrupt their progress, and give defenders the visibility and time they need to respond. 

Ultimately, we may not always be able to stop an attacker taking that first step. Our job is to make everything that comes next difficult, visible and very, very short. 

Wondering how resilient your organisation really is? Get in touch with our Cyber Security team and let’s find out.