More than half of the confirmed exploited vulnerabilities of the 2025 cohort were attacked on or before the day of disclosure. Anyone who only reacts to CVE advisories and patch cycles is defending a window of time that no longer exists. VamiSec operates zero-day monitoring as a managed service — AI-supported, continuous and using the same methods attackers apply today.
From the outside with VamiRedteam · close to the code with VamiAppSec · monitored around the clock by VamiSec
Share of confirmed exploited vulnerabilities that were attacked on or before the day of disclosure. Own illustration, data from the industry initiative zerodayclock.com ↗
The Zero Day Clock — an industry initiative supported by more than 120 experts from security research and industry — measures the interval between the publication of a vulnerability and its first confirmed exploitation. The result across eight CVE cohorts is unambiguous.
Median days between CVE publication and first confirmed exploitation, by CVE cohort. Logarithmic scale. The 2025 cohort reaches 0 days — attack and disclosure fall on the same day.
Sources: Zero Day Clock (data basis: 3,568 confirmed exploited CVEs from CISA KEV, VulnCheck KEV and VulnCheck XDB, disclosure date from the NVD; as of July 2026) and the BSI report on the state of IT security in Germany 2025. The current year 2026 is deliberately not shown, because the source's partial-year figures are not yet consistent.
What until recently was specialist work spanning months is today completed by AI systems within hours — verifiable, publicly documented and on both sides of the front line. This is not a forecast but documented practice.
Together with around 50 partners, Anthropic has found more than ten thousand vulnerabilities of high or critical severity in widely used software. When 1,752 findings were re-examined by independent security firms, 90.6% proved to be genuine — the most robust public quality figure available for AI-supported vulnerability research.
Anthropic, Project Glasswing (2026)A cyber assessment from the same program documents how an AI model independently found and exploited a 17 year old remote code execution flaw in FreeBSD, developed 181 working exploits against Firefox and uncovered a 27 year old OpenBSD bug — at costs in the four- to five-figure range.
Anthropic, Cyber Assessment Mythos Preview (April 2026)In 2024, Google's agent “Big Sleep” became the first AI system to find a genuine, previously unknown vulnerability in the wild (SQLite). In 2025, 20 further findings in widely used open-source software followed — including CVE-2025-6965, a case in which an imminent exploitation was demonstrably cut off in advance.
Google Project Zero / DeepMindIn June 2025, the autonomous pentest agent XBOW became the first non-human participant to reach first place in the HackerOne US leaderboard — after around 90 days and more than a thousand submitted reports.
HackerOne US leaderboard, June 2025In the final of the DARPA AI Cyber Challenge, seven AI systems found 54 of 70 embedded vulnerabilities and patched them in an average of 45 minutes for 152 US dollars per case — and additionally discovered 18 previously unknown real-world vulnerabilities.
DARPA AIxCC, DEF CON 33 (August 2025)Open models with published weights cannot be recalled. Examining a frontier model that was openly released in July 2026, the British and the US AI security institutes found that its safeguards did not prevent attempts at exploit development and offensive operations.
UK AISI & US CAISI, July 2026Anthropic expects that within six to twelve months further providers will hold models of this performance class — and may release them without safeguards. Defenders have to adapt in order to keep pace.
Anthropic, “Expanding Project Glasswing” (June 2026)
Classic vulnerability management is indispensable — but by design it is reactive: it can only take effect once a vulnerability has been published, assessed and a patch is available. That chain is exactly where the risk lies today.
Zero-day monitoring does not replace your vulnerability management. It closes the gap between “not yet published” and “already exploited” — and delivers the evidence you need to prioritize.
VamiSec operates zero-day monitoring with two proprietary, AI-supported platforms — one tests from the outside, from the attacker's perspective, the other with full access to code and build chain. Together they cover what an attacker sees, and what they do not see yet.
AI-native, agentic pentesting platform. Six specialized agents map, model and exploit autonomously — within a signed Authorization Cage.
LLM-supported application security platform. Six scanners in one pipeline, every finding enriched, deduplicated and paired with an actionable fix — right where vulnerabilities arise.
A tool on its own makes no one more secure. As an MSSP we take on the operation, the assessment and the translation into concrete measures — embedded in your processes and your reporting obligations.
We operate both platforms for you: scope definition, authorization, tuning and continuous operation — without you having to build up an offensive team of your own.
Every relevant finding is reviewed by our analysts and substantiated with reproducible proof. You receive confirmed attack paths with a recommended course of action, not lists of hits.
In addition to the platforms, we bring in established testing methods — dynamic analysis, fuzzing, threat modeling and manual penetration tests carried out by certified testers.
Connection to your SIEM/SOAR, your ticketing and your CI/CD pipelines. Findings arrive where your team already works — including a connection to VamiGRC for audit-ready evidence.
Once a vulnerability is actively exploited, the clock is running. We deliver the technical basis for your notifications under CRA, NIS2/BSIG and GDPR — with timestamps and robust documentation.
A technical report with reproduction steps for your team, and a condensed management summary with risk and trend development for the executive level.
No law prescribes “zero-day monitoring” in so many words. But several regulatory frameworks require effective security testing, functioning detection and the reporting of actively exploited vulnerabilities within tight deadlines. That is exactly what this service contributes to.
The Cyber Resilience Act obliges manufacturers to report actively exploited vulnerabilities in their products: early warning within 24 hours, notification within 72 hours, final report no later than 14 days after a corrective measure becomes available. The prerequisite is that the exploitation is noticed at all. Annex I Part II additionally requires effective and regular security testing.
§ 30 Abs. 2 BSIG requires, among other things, risk analysis, the handling of security incidents and an assessment of the effectiveness of the measures; for critical installations, § 31 Abs. 2 additionally requires attack detection systems. Reporting deadlines under § 32: 24 hours, 72 hours, final report one month after the 72-hour notification.
For financial entities, Art. 10 requires mechanisms to detect anomalous activities promptly. Art. 25 explicitly names vulnerability assessments and scans, source code reviews and penetration tests within the testing program; for identified entities, threat-led testing under Art. 26 is added.
Continuous zero-day monitoring maps directly onto A.5.7 (threat intelligence), A.8.8 (management of technical vulnerabilities) and A.8.16 (monitoring activities) — with reports that hold up as evidence in an audit.
Please note: zero-day monitoring is a supporting measure. Which measures are appropriate and proportionate in your case follows from your risk analysis — and that is precisely where we support you. This page does not constitute legal advice.
In a non-binding initial consultation we define the scope, clarify the authorization and show what continuous zero-day monitoring looks like in concrete terms for you.
