> That's not what "zero day" means. It's half of the practical concerns with zero days, and the half that most software teams have the least amount of control

> That's not what "zero day" means. It's half of the practical concerns with zero days, and the half that most software teams have the least amount of control over. > It's great that this vendor has mechanism for quickly distributing security updates, but that isn't going to mitigate zero day vulnerabilities. See: http://www.tripwire.com/state-of-security/incident-detection/drupal-psa-if-you-didnt-patch-within-7-hours-consider-your-site-hacked/ http://www.tripwire.com/state-of-security/incident-detection... > Rather, zero days would be mitigated by SDLC activities that would help them discover novel vulnerabilities in their code, like design/code reviews, static analysis, or fuzzing. That's correct, but nontechnical users aren't interested in these details. What's more interesting to them is "When it's fixed, I won't have to do anything to not be vulnerable." > If they want to reassure their customers that they're good at infosec, then they need to do a lot more than spout some BS about how their automatic update mechanism stops zero days when it can't. I'll refine the wording a bit better. Thanks for the feedback.