Security news is full of zero-day vulnerability disclosures. In reality, the attacks that successfully compromise NZ small businesses almost never involve zero-days. Here's what zero-days are, who they're used against, and why the security basics matter more for most businesses.
A zero-day vulnerability is a software flaw that is unknown to the vendor — no patch exists because the vendor doesn't know they need to release one. The term comes from "zero days to patch" — the vulnerability is being exploited before any defence is available. Zero-days are valuable, expensive to discover, and used selectively.
The reality for NZ small businesses: zero-days are overwhelmingly used against high-value government, military, critical infrastructure, and large corporate targets — by nation-states and sophisticated criminal groups who have invested significantly in finding or purchasing them. The criminal ecosystem targeting NZ SMBs predominantly uses well-known attack techniques against common vulnerabilities. Not because they couldn't find or buy zero-days, but because they don't need to.
What Actually Attacks NZ Small Businesses
CERT NZ and Verizon's DBIR data is clear on this: the attacks that successfully compromise small businesses are overwhelmingly based on: stolen credentials (phished or from data breaches), known software vulnerabilities that have available patches but haven't been applied, misconfigured systems (internet-exposed RDP, weak email security settings), and social engineering. Zero-days don't appear in this picture because they're unnecessary when the simpler techniques succeed at such a high rate.
The Implication for Security Investment
This doesn't mean zero-day risk is irrelevant — it means the priority hierarchy for security investment is clear. Closing the vulnerability to phished credentials (MFA), closing the vulnerability to known software exploits (patch management), and closing the vulnerability to misconfiguration (configuration hardening and monitoring) should all precede exotic threat scenarios. A business without MFA isn't meaningfully more at risk from zero-days — they're at enormous risk from the credential attacks that occur millions of times per day.
Once foundational controls are in place — MFA, EDR, patching, secure configuration — the security conversation can appropriately include more sophisticated threat scenarios. The mistake is when businesses focus on sophisticated threats before securing the basics that stop 80%+ of actual attacks.
Zero-days are real threats, used against real targets. But attackers don't use a $50,000 zero-day when phishing works for free. Closing the door to common attacks is the right security investment for most NZ businesses — starting with MFA, moving through patching, and building from there.
