What is Zero-day?
A vulnerability with no patch available yet — unknown to the vendor or unfixed — so defenders have had "zero days" to address it.
Zero-day: A vulnerability with no patch available yet — unknown to the vendor or unfixed — so defenders have had "zero days" to address it.
In plain language
A zero-day is an unpatched, often unknown vulnerability. The AI-specific risks hitting production right now — prompt injection, exposed system prompts — behave like a permanent zero-day: there is no CVE and no patch, because they exploit how the system fundamentally works.
SuperPentest focuses on exploitability rather than only known signatures, so it can surface novel issues and the unpatchable AI classes — then prove them by reproduction. AI-agent testing →
A concrete example
Your scanner knows every CVE — and none of them cover the prompt-injection flaw in the AI feature you shipped last month, because there is no CVE to know. That class behaves like a standing zero-day: unpatched by nature. SuperPentest tests for exploitability rather than only known signatures, so it can surface the novel and unpatchable issues a signature database cannot.
Related
Prompt injection → · Known CVE testing →
Want this tested on your app? Book a demo or read how findings are verified.