Program Building Zero Day

The first 48 hours after a zero-day, hour by hour

August 25, 2026·9 min read·Chris Boker, Founder, CVEasy AI
A large clock face on the left showing hour zero at the top with a bold mint wedge, a dashed gold pre-disclosure arc on the eleven o'clock side reminding that hour zero is often not hour zero, an amber event dot outside the arc, and three clock hands radiating from the center including a dashed gold hand pointing back into the pre-zero segment, feeding a dashed gold arrow that bends up into a horizontal forty eight hour timeline divided into four proportional windows on the right, a narrow mint window for hours zero to four with ground truth tick rows, a gold window for hours four to twelve with a bold crossed cut motif, a wider surface window for hours twelve to twenty four with a mint behavior waveform under a dark magnifier, and a wide green window for hours twenty four to forty eight holding five surface check plates each stamped with a green tick, hour markers at zero, four, twelve, twenty four, and forty eight along the base, a parallel EU CRA regulatory track beneath the main bar with a green evidence stamp badge on the left and two bold gold vertical markers standing at hour twenty four and hour seventy two, and a stopwatch and evidence stamp pair at the top right sending a dashed dark arrow down into the patch and validate window to signal the stop clock rule

Interlock affiliates were inside Cisco firewall management CVE-2026-20131 (CVSS 10.0) from January 26, 2026, more than a month before Cisco published the advisory. The advisory said hour zero. The ransomware timeline said the clock had been running for weeks. Every zero-day playbook that starts at "the vendor drops the advisory" is starting on someone else's second act.

That is the honest opening for any first-48 conversation in 2026. Verizon's 2026 DBIR put vulnerability exploitation at 31% of initial access, up from 20% in 2025, a 55% year-over-year jump and the first time in nineteen years the vector passed stolen credentials. Edge appliances and VPNs went from 3% to 22% of exploitation-driven breaches, a sevenfold move in a single year. VulnCheck's 1H 2026 report saw median time from CVE publication to KEV evidence fall from 120 to 80 days, with 23.43% of already-confirmed-exploited CVEs showing exploitation on or before the publication date (down from 28.93% in 2025, and the caveat matters: that share is timing on the exploited set, not prevalence across all CVEs).

What the standing playbooks give you, and what they leave out

The prior art is not thin. CISA's Federal Government Cybersecurity Incident and Vulnerability Response Playbooks lay out preparation, identification, containment, eradication, and recovery in the NIST 800-61 tradition. Product-tied SOAR content in XSOAR and ServiceNow ships preformatted runbooks for named CVE families. MSP framings often use a 72-hour operational shape because that maps to a weekend rotation. All of that survives, and this piece does not replace any of it. Zero-day response fails not for want of a phase map; it fails because the phases run on the calendar the vendor sets, and the calendar the vendor sets is now shorter than most phase maps assume.

Two prior directives still matter as reference. ED 22-02 Log4Shell (issued December 17, 2021 with a December 23 deadline) and ED 24-01 Ivanti (disconnect within 48 hours) taught the industry that a federal emergency directive could push a private-sector clock. That device is now historical because the clock is standing.

The federal default is now three days

BOD 26-04 replaced ad hoc emergency directives with a standing tier structure. Of the 39 CVEs CISA added to the Known Exploited Vulnerabilities catalog between June 10 and July 29, 2026, thirty four (87%) carried a three-day-or-less deadline. That is not an emergency exception; it is the default treatment for anything exploited and exposed. Contractors and vendors of federal systems inherit the shape by procurement pressure, and every other practitioner is watching the private-sector benchmark converge on the same clock.

The parallel EU regulatory track

From September 11, 2026 the EU Cyber Resilience Act requires manufacturers of products with digital elements to file a 24-hour early warning and a 72-hour notification for actively exploited vulnerabilities through ENISA's Single Reporting Platform. Any team that ships software into the EU now runs a parallel regulatory clock on top of the technical one. Route the notification path in peacetime, decide in advance which internal role signs the ENISA filing, and pre-draft the fields that will be known by hour four. Hour six is the wrong time to discover who owns the paperwork.

Four windows in the first 48

The thesis: zero-day response fails when teams run it as an accelerated patch cycle. It is an intelligence and containment problem, and the fix arrives in the middle of it, not at the start. Four windows in sequence, each with its own success test, so a team can tell in the moment whether the window closed cleanly or leaked into the next one.

Hours 0 to 4, ground truth

The only question that matters in the first four hours is "do we run the affected product, which versions, where, and which instances are internet-facing." Everything else waits. An asset inventory that cannot answer that in minutes will make everything downstream slow, which is the quiet argument for an asset identity graph before there is a fire. Success test at the end of the window: a written list of affected assets sorted by internet exposure, tagged with owner, in a ticket. Not a query result on a shared screen. A list, in a system of record, with a name against every row.

Hours 4 to 12, reduce exposure while facts are incomplete

Vendor guidance is not always right at hour four. Sometimes the mitigation is worse than the exposure it was written to reduce, and sometimes the mitigation is a workaround that only covers the first published exploitation path. Do it anyway. Restrict management-plane access to a jump host, disable the vulnerable feature where the business will tolerate it, apply the vendor's temporary configuration, and record every reduction as a compensating control on every affected asset with a timestamp and the initials of the person who made the change. This window is where the exposure curve bends, not where the CVE closes.

Hours 12 to 24, hunt on behavior

Signature-based IOCs are thin in the first day. Named indicators are downstream artifacts of the specific tooling seen in the first few victim reports, and mature actors rotate them fast. Hunt on behavior of the affected feature instead: outbound connections from a component that should never egress, new process trees from a service that historically has one, config changes that touch identity paths, and authentication anomalies against the affected surface. Feed the hunt hypotheses into the SIEM as saved queries, run them across the last thirty days as a backfill (remember Interlock and Cisco), and repeat the run every four hours until the patch wave completes.

Hours 24 to 48, patch by exposure band and validate as you go

Patch the internet-facing instances first, in the order the ground-truth list gave you, and record the deployment against each ticket at the moment it happens. Then validate, per instance: a rescan tuned to the exploit path, or an attack-path replay that shows the fix holds under the technique that made the CVE dangerous. The remediation pyramid holds here, so deployed is not fixed and rescanned is not always fixed either. Close each ticket with the validation evidence attached, not the change ticket alone. The evidence trail you write during the incident is the report you will owe on Monday, the audit you will owe next quarter, and the tabletop you will run next year.

The honest capacity picture

The DBIR found only 26% of CISA KEV entries fully remediated across 13,000-plus organizations, with median time to full remediation at 43 days. Design the playbook for what a program does when it misses the 48-hour target, not only for what it does when it hits. The escalation path that surfaces the tickets past hour 48, the exception path with an expiration, and the reporting cadence that shows the shape of the miss rather than hiding it are the part of this playbook most programs skip. The band is the contract; the miss handling is the program.

What to pre-build in peacetime

Three artifacts turn the 48-hour window from improvisation into rehearsal.

  • The zero-day tabletop. A once-a-quarter drill against a composite scenario that names an owner for every action in every window and records the actual times to owner assignment, mitigation, and validation. Run it against edge-appliance shapes because that is where 2026's exposure lives.
  • The query pack. A versioned library of behavior hunt queries per class of exposure (management plane, authentication surface, SSL VPN, hypervisor plane, mail relay), so hour twelve does not begin with a blank editor. Store it with the same rigor as detection content and re-run it against the last drill's telemetry so it does not rot.
  • The comms template. Three pre-written notices (internal engineering, business owners, and where applicable the ENISA filing skeleton), each with the fields that will be known at hour four already left as placeholders. Legal and communications sign the template once, so hour six is not spent negotiating language.

Where the local model sits

CVEasy AI runs the ground-truth query and the validation loop on a local-first Continuous Threat Exposure Management platform, with TRIS holding the band decision on every affected asset so the playbook has one ordered list to work down instead of five. The tooling holds the receipts; the playbook is the work.

Related Reading

Program Building
The SLA clock: start, stop, re-band
The re-banding trigger taxonomy and clock arithmetic that decide which queue this playbook's tickets land in.
Architecture
The asset identity graph
The inventory model that lets hour four end with a named-owner list instead of a spreadsheet.
Program
The remediation pyramid
Deployed is not fixed. Rescanned is not always fixed. The validation ladder this playbook's hour 24 to 48 closes against.