The clock starts when a 0-day surfaces. How long before attackers strike?

Attackers often exploit new vulnerabilities before defenders can react, sometimes before the vulnerability even gets a public ID (a CVE).
Ethiack Zero is a live tracker of that race between attackers and defenders.

Zero is Ethiack’s public record of emerging 0-days. It turns early signals and patches into a working proof of exploit, then publishes how fast it validates each vulnerability (time-to-validate) next to how fast attackers exploited it (time-to-exploit).

explore live feed

Vulnerability Time-to-validate (TTV)live

How fast Ethiack Zero proves a vulnerability is exploitable. The curve shows how many were confirmed at each point in time; a dot is one still validating or waiting for its CVE. The further left, the earlier it was confirmed. The centre line is the moment the vulnerability was fully disclosed on cve.org.

timeline distribution

44% validated987 of 2,2257% before t=0

Peak

t +2.5 hrs

Median Time to Validate

t +5.1 hrs

cve.org publication

t = 0

−72h−48h−24ht=0+24h+32h

validated before cve.org publicationvalidated after cve.org publicationvalidatingvalidated but not published

Vulnerability Timeline

From first warning to first attack. The typical journey of a new vulnerability, using median times. Time zero is the official disclosure of the vulnerability on cve.org.

step 1

signal ingested

A new vulnerability surfaces

step 2

validating

3h 20m

How fast Zero starts validating it

step 3

validated

+5h 04m

How fast we confirm if it's exploitable

step 4