Methodology
Zero measures what we did and when, from public signals to a validated check or exploit, all anchored to cve.org publication. Here is exactly how an entry opens, how the numbers are defined, and what the feed can and cannot claim.
01What starts an entry
Zero watches for public signals that a new vulnerability exists, e.g. news, a vendor advisory, a KEV, a GHSA or the CVE record itself when that is the signal that triggers the analysis.
A vulnerability enters the analysis pipeline automatically when it clears multiple gates:
- The vector must be network-reachable
- High or critical severity only, or also medium if a KEV catalogue lists it
- A computed priority score, where repeated advisories for one product score it up
- A limited number are admitted per pass, best priority score first
We prioritize our queue based on impact, technology popularity, and other criteria. We do not remove the ones the engine can't analyze or reverse, as they may be retried later as new information becomes available.
Signal timestamps are available. Intervals on this page are anchored to when the signal appeared, not when we saw it. Each entry publishes both. Each entry also gets a specific Ethiack ID (ETK id) when it opens.
02Definitions
- t = 0: publication of the CVE record on cve.org.
- Every interval here is measured from that moment. Disclosure and publication may not be the same event, but we anchor to CVE publication because it is the moment when everyone is aware and it becomes mainstream knowledge.
- TTV (time to validate).
- When Ethiack had a working module, measured against t = 0. Signed: T−15h means we validated fifteen hours before the CVE was published on cve.org. T+4h means four hours after.
- TTE (time to exploit).
- The vulnerability's first appearance in a Known Exploited Vulnerabilities catalogue, measured against t = 0. We use multiple catalogues, also tracked by Zero Day Clock, including CISA KEV, EUVD KEV, and VulnCheck KEV, and take the earliest listing across them.
- The two numbers describe different populations.
- TTV is measured across the entries in this feed. TTE is measured across all KEV-listed CVEs. About 1.4% of the records the CVE Project has published appear in a KEV listing, so a lot of entries won't have a TTE. Where one exists, it appears on the entry.
- ETK id: our handle for an entry.
- e.g. ETK-2026-1337, allocated in order as entries open. We open an entry when our analysis starts, which can be before a CVE exists. Those are the entries with the earliest lead. The ETK id is what lets an entry be cited from the moment it opens. When a CVE is assigned later, the entry adopts it. The ETK id does not change, and both handles resolve to the same entry: /api/v1/feed/ETK-2026-1337 and /api/v1/feed/CVE-2026-12345 are the same page. An ETK id is not a CVE and does not stand in for one. We are not a CNA and we assign nothing.
03Outcomes
Proven exploitable
An Ethiack agent produced or reused a high-confidence full exploit against an isolated deployment of the affected product.
Check available
A check fires on a vulnerable deployment and stays silent on a patched one, identifying whether an affected release is present without being a full exploit. Either our pipeline validated it, or it is an external public detection.
Not validated yet
We attempted to understand the vulnerability within a fixed time box and reached neither a high-confidence exploit nor a working check. The entry stays in the list and may be re-attempted when new signals arrive.
When we get something wrong
A check that misfires or a full exploit that does not reproduce: the entry stays and is marked corrected. The medians are recalculated if a correction is done.
04What we publish
Public, for every entry
The vulnerability ID, AI analysis time, all timings with their source signals, 3rd party public PoCs and KEV state, and a mitigation we write from the collected information: the version to move to or a specific commit, otherwise what reduces exposure. Available here and via our Ethiack Zero API/MCP endpoints.
In Ethiack Portal, for customers
A validated check or exploit is deployed into the Hackian engine, and then runs instantly against their attack surface. Finding details are submitted to them.
Never published
Working exploit code. Holding it back gives defenders time to patch before it circulates. However, we may release blog posts in certain cases after sufficient time has passed.
How the figures are calculated
Median TTV is taken across every entry that produced a check or an exploit and has a t = 0, cumulative since launch. Entries that reached neither contribute no TTV and are not in the median.
Entries not yet published on cve.org have no t = 0 and are excluded from the median. They appear in the feed with a live counter: T−14h and counting. Their TTV fixes when cve.org publishes the entry details.
Entries where the CVE record was itself the trigger signal have a positive TTV.
05Ethics and disclosure
Ethiack is a team of hackers. We believe the game is still the same, but it's faster than ever, so defenders need to adapt.
- How checks or exploits are developed:
- Against isolated deployments of the vendor's own released software. Never against a customer system, never against anyone else's.
- What runs against customer attack surface:
- Checks or exploits. Generated probes are reviewed against a written policy that refuses destruction, persistence, denial of service and any connection off the target.
- We don't publish working exploit or PoCs:
- Gives defenders more time and technical details are shared only with trusted partners or researchers. We may release blog posts or PoCs in certain cases, especially when it benefits the security community.
06What this page cannot tell you
Zero measures what we did and when. It cannot measure the following:
- When attackers actually had an exploit.
- TTE is the first date a catalogue listed a vulnerability as exploited. Cataloguing follows confirmation, which follows observation, which follows the attack. TTE is therefore a floor on when exploitation became publicly known. The real interval is shorter than TTE shows.
- Whether our exploitation claims are independently verifiable.
- They are not, from this page or the Zero API. Our exploits are never published, so a visitor can check our timings but not our proofs. However, we try to be as transparent as possible: failures are left in place, corrections marked rather than erased.
- Coverage beyond what we support.
- Our pipeline doesn't analyze all vulnerabilities. We prioritize them and may miss multiple public signals. A significant vulnerability absent from this feed should never be treated as evidence, only that we were not watching that surface or that our algorithm didn't prioritize it correctly.
- Whether the absence of a KEV listing means safety.
- Roughly 1.4% of published CVEs ever receive one. No listing is not evidence that nobody used it in attacks.
07API
The feed API is public and requires no authentication.
An MCP server is available at https://zero.ethiack.com/mcp (Streamable HTTP, read-only, no authentication), with the same data as the API:
Every interval on this page derives from those timestamps, so our medians can be calculated independently.
08Questions or feedback?
Please reach out to us at [email protected]. We welcome any questions, feedback, or suggestions regarding our methodology and feed.