Zero-Day Response

1. Purpose & Scope

• Purpose:

  Provide a structured response for zero-day vulnerabilities where no vendor patch or durable fix is available. Use this playbook to validate exposure, reduce exploitability, monitor for exploitation, coordinate vendor communications, and transition to remediation when a fix becomes available.

• Scope:

  Applies to newly disclosed or privately reported vulnerabilities affecting organisational assets when exploitation risk exists and no patch, upgrade, or durable remediation is available. If exploitation is confirmed, invoke PB-015.

2. Incident Identification & Criteria

Incident Type: Zero-Day Response

Trigger Conditions:

Initiate this playbook when any of the following occur:

• A zero-day vulnerability affects organisational technology and no patch or durable fix is available
• Vendor advisory, threat intelligence, researcher report, or internal finding identifies high-risk exposure without remediation
• Public exploit code, active threat activity, or emergency mitigation guidance exists before a patch is released
• Vulnerability response determines that only temporary containment or compensating controls are currently possible

Severity Levels:

3. Roles & Responsibilities

• Incident Commander: Sets severity, coordinates response, approves containment tradeoffs, and owns escalation decisions.
• Vulnerability Management Lead: Tracks advisory status, exposure, mitigations, patch availability, and remediation planning.
• Technical Lead: Coordinates compensating controls, monitoring, validation, and transition to remediation.
• Communications Lead: Coordinates internal, executive, legal, vendor, customer, and stakeholder communications.
• Other Roles:
  • System / Application Owners: Implement mitigations, test service impact, and prepare for patching.
  • Cloud / Network / Platform Teams: Apply segmentation, access restrictions, WAF/CDN rules, provider controls, and monitoring.
  • Legal / Compliance: Reviews disclosure, customer, contractual, regulatory, and law enforcement implications.

4. Initial Actions

• Immediate Steps:

  • Validate the vulnerability, affected product/version, exposure conditions, and lack of available patch or durable fix.
    • 📘 RB-TRIAGE-009: Vulnerability Validation
  • Assess vendor guidance, threat intelligence, exploit availability, active campaigns, and emergency mitigations.
    • 📘 RB-ANALYSIS-042: Vulnerability Threat Intelligence Assessment
  • Identify asset owners, business owners, affected services, and emergency decision makers.
  • Contact vendor or provider when clarification, mitigations, timelines, or support are needed.
    • 📘 SOP-005: Vendor Communication During a Security Incident
  • Engage vulnerability management, platform owners, system/application owners, and IR leadership.
    • 📘 SOP-001: Paging an Engineering Team's On-Call

  Decision Point:

  • If exploitation is confirmed → execute PB-015: Active Exploitation immediately.
  • If a patch, upgrade, or durable fix is available → execute PB-017: Vulnerability Response.
  • If no patch or durable fix is available → continue this playbook.

5. Investigation & Analysis

Common Failure Modes: >- Waiting for a patch while leaving exposed systems reachable >- Treating compensating controls as permanent remediation > - Failing to monitor for exploitation while no patch exists > - Missing cloud, SaaS, third-party, or unsupported asset exposure > - Not transitioning to vulnerability response once a fix becomes available

• Evidence Collection:

  • Collect vendor advisories, threat intelligence, affected versions, exposure data, asset inventories, mitigations, and detection coverage.
  • Preserve relevant telemetry where exploitation is suspected.

• Analysis Steps:

  • Assess exposure requirements, affected attack paths, accessibility, business criticality, and potential impact.
    • 📘 RB-ANALYSIS-039: Vulnerability Exposure Assessment
  • Identify all vulnerable assets, owners, versions, environments, and compensating-control groups.
    • 📘 RB-ANALYSIS-040: Vulnerable Asset Identification
  • Verify whether exploitation has occurred or is occurring.
    • 📘 RB-ANALYSIS-041: Exploitation Verification
  • Monitor for exploitation indicators across endpoint, identity, cloud, web, network, and application telemetry.
    • 📘 RB-TRIAGE-002: EDR Alert Triage
    • 📘 RB-TRIAGE-003: Identity Alert Triage
    • 📘 RB-TRIAGE-011: Cloud Platform Alert Triage
    • 📘 RB-TRIAGE-012: Web Application Attack Triage

  Decision Point: Run the post-detection phases (Analysis → Recovery) of any relevant sibling playbook concurrently alongside this one based on what was observed:

  • If exploitation is confirmed → execute PB-015: Active Exploitation concurrently.
  • If a patch or durable fix becomes available → transition to PB-017: Vulnerability Response.
  • If malware or suspicious execution is identified → execute PB-003: Endpoint Malware Infection or PB-011: Suspicious Execution concurrently.
  • If account compromise or credential abuse is identified → execute PB-004: Account Takeover concurrently.
  • If data exposure, staging, or exfiltration is identified → execute PB-005: Data Exfiltration concurrently.
  • If cloud compromise is identified → execute PB-007: Cloud Compromise concurrently.
  • If web application compromise is identified → execute PB-008: Web Application Attack concurrently.

6. Containment, Eradication & Recovery

• Containment Actions:

  • Reduce exposure using compensating controls such as access restrictions, segmentation, WAF rules, feature disablement, protocol blocking, configuration changes, or service isolation.
    • 📘 RB-CONTAIN-014: Vulnerability Exposure Reduction
  • Apply exploit-path containment if threat intelligence indicates active targeting or high exploitability.
    • 📘 RB-CONTAIN-012: Exploitation Surface Containment
  • Restrict cloud workloads or web application access where affected assets cannot be safely exposed.
    • 📘 RB-CONTAIN-015: Cloud Workload Isolation
    • 📘 RB-CONTAIN-016: Web Application Access Restriction

• Eradication Steps:

  • Maintain temporary mitigations until a patch, upgrade, replacement, or durable configuration fix is available.
  • Remove exposed features, vulnerable services, integrations, or components if risk cannot be reduced safely.
  • Prepare emergency remediation plans for when a vendor fix becomes available.

• Recovery Steps:

  • Transition to PB-017 once a patch, upgrade, or durable fix is available.
  • Validate compensating controls remain effective until permanent remediation is complete.
    • 📘 RB-RECOVERY-007: Vulnerability Remediation Validation
  • Track accepted residual risk, exceptions, compensating controls, and review dates.

7. Communication & Escalation

• Internal Communication:

  • Notify security leadership, vulnerability management, system/application owners, platform owners, and impacted business stakeholders.
  • Use geo handoff where response spans shifts.
    • 📘 SOP-002: Incident Handoff Between Geos

• External Communication:

  • Coordinate vendor, customer, regulator, executive, and legal communications through approved processes.
    • 📘 SOP-003: Escalation, Legal & Executive Communications
    • 📘 SOP-005: Vendor Communication During a Security Incident

• Escalation Criteria:

  Condition	Escalate To
  Exploitation confirmed	PB-015: Active Exploitation
  Patch, upgrade, or durable fix becomes available	PB-017: Vulnerability Response
  Malware or suspicious execution identified	PB-003: Endpoint Malware Infection / PB-011: Suspicious Execution
  Account compromise or credential abuse identified	PB-004: Account Takeover
  Data exposure, staging, or exfiltration identified	PB-005: Data Exfiltration
  Cloud compromise identified	PB-007: Cloud Compromise
  Web application compromise identified	PB-008: Web Application Attack
  Major business impact, emergency shutdown, or widespread exposure	PB-019: Major Security Incident Management

8. Post-Incident Activities

• Lessons Learned:

  • Conduct a PIR covering zero-day intake, exposure assessment, mitigation timing, vendor coordination, monitoring coverage, and transition to remediation.
  • Review whether compensating controls, asset inventory, threat intelligence, and communication paths were sufficient.

• Documentation Updates:

  • Update vulnerability records, mitigations, monitoring content, vendor contacts, exception tracking, runbooks, and this playbook based on lessons learned.

9. References & Linked Resources

• Playbooks:

  • PB-003: Endpoint Malware Infection
  • PB-004: Account Takeover
  • PB-005: Data Exfiltration
  • PB-007: Cloud Compromise
  • PB-008: Web Application Attack
  • PB-011: Suspicious Execution
  • PB-015: Active Exploitation
  • PB-017: Vulnerability Response
  • PB-019: Major Security Incident Management

• Runbooks:

  • RB-TRIAGE-002: EDR Alert Triage
  • RB-TRIAGE-003: Identity Alert Triage
  • RB-TRIAGE-009: Vulnerability Validation
  • RB-TRIAGE-011: Cloud Platform Alert Triage
  • RB-TRIAGE-012: Web Application Attack Triage
  • RB-ANALYSIS-039: Vulnerability Exposure Assessment
  • RB-ANALYSIS-040: Vulnerable Asset Identification
  • RB-ANALYSIS-041: Exploitation Verification
  • RB-ANALYSIS-042: Vulnerability Threat Intelligence Assessment
  • RB-CONTAIN-012: Exploitation Surface Containment
  • RB-CONTAIN-014: Vulnerability Exposure Reduction
  • RB-CONTAIN-015: Cloud Workload Isolation
  • RB-CONTAIN-016: Web Application Access Restriction
  • RB-RECOVERY-007: Vulnerability Remediation Validation

• SOPs:

  • SOP-001: Paging an Engineering Team's On-Call
  • SOP-002: Incident Handoff Between Geos
  • SOP-003: Escalation, Legal & Executive Communications
  • SOP-005: Vendor Communication During a Security Incident

10. Appendices

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Contributed to the Arcana Incident Response Documentation Framework.