Zero-Day Vulnerabilities, Cartography, and Quantification Initiative

Abstract

Zero-day vulnerabilities have become a critical concern across security teams. Despite their growing frequency, they remain a largely uncharted domain: there is currently no consolidated information, statistical visibility, or cartography describing the true scale of the problem. Organisations lack metrics that would enable them to understand how zero-days are distributed among products or technological ecosystems, limiting their ability to anticipate, detect, and accurately assess the risks associated with these vulnerabilities. In the absence of a structural understanding of the phenomenon, organisations rely on linear, product-centred approaches inherited from traditional vulnerability management and built around indicators such as CVE identifiers, CVSS scores, or patch availability. Although these indicators are essential, they do not capture the multidimensional relationships and ecosystem-level dependencies that shape zero-day behaviour. Consequently, analyses remain confined to individual vulnerabilities rather than the structures that connect them, leaving organisations without models capable of describing how zero-days emerge, cluster, or propagate across technologies. To address this gap, this work begins with an in-depth a posteriori phase aimed at establishing the first consolidated inventory of past zero-days. This fundamental effort is intended to establish an initial structural basis that will enable further long-term research into the systemic characteristics of zero-day vulnerabilities.  Afterwards, this study seeks to reveal “domino effects”, clusters of technological weakness, and cross-product propagation paths that remain invisible in traditional analytical frameworks. The goal is to provide a new visualisation to support not only future predictive models and improved detection strategies, but also more informed and contextualised risk assessments. By moving beyond linear scoring systems and embracing a structural, graph-driven perspective, this work lays the groundwork for a more proactive, comprehensive understanding of zero-day vulnerabilities and the technological ecosystems they inhabit.