Why We Need to Stop Panicking About Zero Days

The speaker, a threat intelligence director, opens by arguing that online warnings about zero-day flaws often spread panic through groupthink, a wish to prove one's work matters, and shiny-object distraction from foundational tasks. She links that constant alarm to burnout in the security community. She frames a vulnerability as an unlocked door: it only becomes a problem when an adversary walks through it.

Drawing on CISA's known-exploited catalog and GreyNoise reporting, she shows that most exploited vulnerabilities are older than the current year, and that even state-sponsored groups keep using aged flaws, such as a Cisco router bug, rather than spending rare zero days. She then describes a recurring intrusion pattern: attackers breach an internet-facing appliance like a VPN or firewall, plant web shells, move laterally, often over RDP, and dump credentials. Mapping a newly disclosed zero day onto this path helps teams predict where to look and where monitoring is weakest.

For defenders, she recommends a written plan for handling vulnerabilities, not only incidents. Start by confirming whether you run the affected product, using asset inventories and even finance records. Then weigh the flaw type, check whether anyone has seen it exploited, and judge how hard patching would be before relying on mitigations. Finally, she asks the community to stop amplifying fear and to share useful mitigations and detection analytics instead.