Vulnerability Lifecycle
Every zero-day vulnerability moves through a predictable set of stages — from the moment it's introduced in code to the moment it's finally patched. Understanding this lifecycle helps explain why some vulnerabilities stay hidden for years while others are exploited within hours of discovery.
The Five Stages
Discovery
A flaw is found in software — either by a security researcher running audits and fuzzers, or by an attacker probing for weaknesses. At this point, the vendor usually has no idea the flaw exists.
Analysis
The finder studies the bug to understand what it actually allows — code execution, privilege escalation, data leakage — and how reliably it can be triggered. This determines how dangerous it really is.
Weaponization / Exploitation
If an attacker has the vulnerability, they may build a working exploit and use it quietly, often for as long as possible, since going public or getting caught ends its usefulness. This is the most dangerous window in the lifecycle — the vendor has had zero daysto prepare a fix.
Disclosure
A researcher who finds the bug typically reports it privately to the vendor — this is called responsible disclosure — and agrees to withhold public details for a fixed window (often 90 days) so the vendor has time to fix it before attackers can weaponize it.
Patch & Remediation
The vendor releases a fix. But the lifecycle doesn't truly end here — the vulnerability stays dangerous to anyone who hasn't updated, which is why unpatched systems remain exploitable long after a fix exists.
Disclosure Models
Not every vulnerability follows the "report privately, wait, then fix" path. There are a few common approaches, each with tradeoffs:
- Responsible / Coordinated Disclosure — the finder gives the vendor time to patch before going public. The industry standard.
- Full Disclosure — details are published immediately, pressuring vendors to act fast, but also arming attackers instantly.
- Bug Bounty Programs — vendors pay researchers to report bugs through a structured, incentivized process.
- Zero-Day Markets — some vulnerabilities are sold rather than disclosed, to governments, brokers, or on the black market.
Why Timing Matters
Once a fix ships, attackers can often reverse-engineer the patch to build an exploit for anyone who hasn't updated yet.
A patched-but-unapplied vulnerability is called an "n-day" — technically known, but still exploitable in the wild.
The gap between patch release and patch adoption is where most real-world breaches actually happen.