Zero-day exploits hit enterprises faster and harder

Google's Threat Intelligence Group tracked 90 zero-day vulnerabilities exploited in 2025, with Chinese state-sponsored groups doubling their count and commercial surveillance vendors surpassing state actors in attributed zero-days for the first time. Nearly half of all zero-days targeted enterprise technologies, especially security appliances, VPNs, and networking devices. The window between public disclosure and active exploitation is shrinking — nearly a third of exploited vulnerabilities were attacked on or before their disclosure date. Ransomware groups also doubled their zero-day usage. Recommendations include network segmentation, emergency patching processes, software bills of materials, real-time asset inventories, and least-privilege architecture to reduce exposure.