Framework · AI Security

Zero Day to Zero Sec

Why context, not speed, is the defender's binding constraint

Zero Day to Zero Sec names what happened to the window that gave "zero-day" its meaning. A zero-day was never really about the vulnerability; it was about time — the interval between an exploit becoming usable and a defense existing, historically measured in days or weeks. Autonomous attack compresses that interval toward zero. The common conclusion is that defenders must therefore respond at machine speed themselves. That conclusion is incomplete. Speed is not the defender's binding constraint; context is. Reaction time only matters if the reacting party — human analyst now, automated system later — already understands what it is looking at: what AI systems exist, what each can reach, and what normal behavior looks like. That understanding cannot be acquired during an incident that outruns you. Whatever ends up defending your systems is capped by the picture you captured before the attack began. A faster defender without that picture is not a defense. It is the same blindness, arriving sooner.

The window that gave the term its name

"Zero-day" was always a measurement of time. Not a class of bug — a countdown. It described the gap between the moment an exploit became usable and the moment a fix existed, and the whole discipline of incident response was built inside that gap. Days to notice. Days to triage. Days to patch. Unpleasant, but survivable, because the attacker was also working at human pace.

Autonomous attack removes the attacker's half of that assumption. One documented intrusion needed nothing clever — one unpatched flaw and enough time to work alone — and produced 1,342 encrypted production records, self-correcting from a failed login in 31 seconds. Independent findings show AI already running full attack chains with minimal human steering. The precedent is on record: a single model instance ran the large majority of a state-linked espionage operation across roughly thirty organizations, largely on its own.

That is the shift the name marks. Zero day to zero sec. The interval defenders were built to operate inside has closed.

Where the industry's answer stops short

The near-universal conclusion is that defenders must match the speed — autonomous detection, autonomous response, fight AI with AI. It is not wrong. It is just not the constraint.

Speed only converts into defense when the thing moving fast already understands what it is looking at. An autonomous responder that does not know which AI systems you run, what each one can reach, or what ordinary behavior looks like for them does not defend you quickly. It reaches the wrong conclusion quickly, or no conclusion at all.

This matters most against the failure mode that speed alone cannot see: several agents dividing an attack so that each individual action looks harmless, and only the full pattern across all of them tells the story. Catching that requires reasoning across a string of separately unremarkable events. No amount of reaction speed substitutes for knowing what the events mean.

Context is acquired before, or not at all

Here is the asymmetry that actually decides the outcome. The attacker arrives having already mapped what matters — that is what the intrusion is for. The defender is expected to assemble the same understanding while the incident is running, at a speed the incident does not allow.

That is not a resourcing problem you can solve under pressure. Context is inventory, reachability, and behavioral baseline, and all three take time to establish precisely because they describe a steady state. You cannot observe a steady state during an emergency.

So the picture you will have at the moment of attack is the picture you captured before it. Everything else — detection, triage, containment, automation — operates on top of that, and inherits its gaps.

How to apply it

Stop treating readiness as a response-time metric. Mean time to respond measures the wrong half once the attacker is autonomous; it flatters teams that react quickly to things they were already equipped to understand and says nothing about the case where they aren't.

Measure completeness of context instead, and measure it today: can you enumerate every AI system and agent you run, what each can reach, what identities and data are within its blast radius, and what normal looks like for it? Whatever is missing from that answer is missing from your defense, and cannot be recovered mid-incident.

Then decide about autonomy second, not first. Automated response is a genuine amplifier — of whatever context it is given. Deploy it on top of a complete picture and it compounds; deploy it on top of an incomplete one and it compounds that instead.

Zero Day to Zero Sec was introduced by Asaf Nakash, Principal Product Manager for AI Security at Microsoft Defender and host of the Context Window podcast, in Context Window Edition #24 (July 20, 2026).

Common questions

What does "zero day to zero sec" mean?

It is a term coined by Asaf Nakash, Principal Product Manager for AI Security at Microsoft Defender, for the collapse of the exploitation window under autonomous attack. "Zero-day" originally described a period of time — the gap between an exploit becoming usable and a defense existing, historically days or weeks. Autonomous agents compress that gap toward zero, so the interval that incident response was designed to operate inside effectively disappears.

If attacks run at machine speed, shouldn't defense be automated too?

Eventually, yes — but speed is not the binding constraint, and treating it as the first problem leads to the wrong investment. An automated responder is an amplifier of the context it is given. If it does not know which AI systems exist, what each can reach, and what normal behavior looks like, it reaches wrong conclusions faster rather than defending faster. Autonomy is a multiplier applied to context, so the context has to exist first.

Why can't defenders build context during an incident?

Because context is inventory, reachability, and behavioral baseline — and all three describe a steady state, which cannot be observed during an emergency. The attacker arrives having already mapped what matters; the defender is expected to assemble the equivalent understanding while an incident runs at a speed that does not permit it. Whatever picture you captured before the attack is the picture you will have during it.

How is this different from "machine-speed attacks"?

"Machine-speed attacks" describes the observation that offensive operations now outpace human response, and generally concludes that defenders should match that speed. Zero Day to Zero Sec accepts the observation and rejects the conclusion as incomplete. Its claim is that reaction speed is not what limits defenders — pre-assembled context is — so the decisive investment is completeness of understanding captured in advance, not response latency.

What should a security team actually measure?

Completeness of context rather than mean time to respond. Concretely: whether you can enumerate every AI system and agent in the environment, what each can reach, which identities and data fall inside its blast radius, and what normal behavior looks like for it. Gaps in that inventory are gaps in the defense, and they cannot be closed once an incident is under way.

Where this comes from

#24 · The Swarm Isn't Here Yet. The Speed Already Is.#21 · The Level Playing Field Is Ending#23 · You Can't Lower the Odds Anymore. Lower the Blast Radius.