The clock starts when a 0-day surfaces. How long before attackers strike?

Attackers often exploit new vulnerabilities before defenders can react, sometimes before the vulnerability even gets a public ID (a CVE).
Ethiack Zero is a live tracker of that race between attackers and defenders.

Zero is Ethiack’s public record of emerging 0-days. It turns early signals and patches into a working proof of exploit, then publishes how fast it validates each vulnerability (time-to-validate) next to how fast attackers exploited it (time-to-exploit).

explore live feed

Vulnerability Time-to-validate (TTV)live

How fast Ethiack Zero proves a vulnerability is exploitable. Each dot is one vulnerability. The further left, the earlier it was confirmed. The centre line is the moment the vulnerability was fully disclosed on cve.org.

timeline distribution

44% validated993 of 2,2447% before t=0

1,500 of 2,244 drawn

TTV

−8d−6d−4d−2dt=0+4d+8d+12d+16d+20d+24d

validated before cve.org publicationvalidated after cve.org publicationvalidatingvalidated but not published

Vulnerability Timeline

From first warning to first attack. The typical journey of a new vulnerability, using median times. Time zero is the official disclosure of the vulnerability on cve.org.

step 1

signal ingested

A new vulnerability surfaces

step 2

validating

3h 22m

How fast Zero starts validating it

step 3

validated

+5h 07m

How fast we confirm if it's exploitable

step 4