An executive is told 'it was a zero-day, so nothing would have stopped it' — what do you fund?

## Why this sentence needs answering rather than agreeing with 'It was a zero-day, so nothing would have stopped it' does two things at once. It explains an event, and it closes a budget conversation. The second is the reason it needs handling: if the label stands, the organisation has just concluded that the loss was unavoidable, and every improvement that would have actually helped becomes unfundable. The sentence is not automatically wrong. It is simply a claim, and it has a hard, checkable core. ## Step one: test the claim 'Zero-day' asserts one narrow, verifiable thing: **no vendor fix existed at the moment of use**. Two facts settle it — the vendor's release history for the affected component, and the version that was actually running when the event occurred. In practice most claims do not survive this. What is usually found is that a fix existed and had not taken effect on the machine involved. That is a completely different finding: an addressable gap in how quickly corrected code starts running, not an act of god. The label was doing the work of hiding it, and typically nobody applied it dishonestly — 'zero-day' is simply what people say when a compromise feels unexpected. ## Step two: bound what the claim covers even if it holds Suppose the check passes and no fix existed. The sentence still overreaches. 'No fix existed' means one specific control could not have prevented this event. It does not mean the event was invisible, unbounded, or beyond every other kind of intervention. The scope of the claim is one control, and saying so plainly is what stops the conversation ending there. ## Step three: say what money actually buys This is the part an executive can act on, and it needs to be stated as a trade, not a wish. - **A shorter clock is purchasable.** The interval between a fix existing and corrected code actually running in your estate is measurable, improvable, and it is where the overwhelming majority of real compromises land. Shortening it is unglamorous — it is about how quickly updates reach machines and how quickly long-running programs restart — and it is the highest-return item on the list precisely because the unfixed case is rare and the fixed-but-not-running case is not. - **Immunity from unfixed flaws is not purchasable**, and any spend justified as buying it should be challenged. If a control earns its budget, it earns it on what it does generally, not on a promise about a category defined by nobody knowing about it yet. - **The remainder is residual risk, and it needs an owner.** The correct outcome of this conversation is not that the risk is eliminated but that a named executive has looked at the size of it and accepted it in writing. That converts an argument that recurs after every incident into a decision with a date on it. ## Step four: guard the narrative for next time The organisational failure mode is that 'zero-day' becomes the default explanation for anything surprising. Once that happens, the same unfixed-but-fixable gap can produce compromise after compromise, each one narrated as unavoidable and none of them funded. The cheap countermeasure is procedural: require that the phrase be accompanied by the two facts that support it — the fix availability date, and the version that was running — before it enters any report that goes upward. If those two facts are not present, the sentence is a hypothesis. ## What a strong answer sounds like in the room 'Give me a day. If a fix existed when this happened, then the thing to fund is how long our software takes to actually start running fixes, and I can show you that number and where it would land after the spend. If no fix existed, I will tell you that too, and my recommendation will still be the same number, because that is the risk we can actually move — and I will bring you the piece we are choosing to accept so you can decide whether to accept it.' That answer is fundable, honest about what cannot be bought, and it does not let the label end the discussion. ## Common wrong answers - **Agreeing.** 'Zero-days are unstoppable' concedes the budget and the improvement in one sentence. - **Overpromising.** Claiming a purchase will handle unfixed flaws sets up the next conversation to be worse, because the next event will happen anyway. - **Winning the argument and stopping.** Proving it was an n-day and not converting that into a funded change to the clock leaves the organisation exactly where it was, minus some goodwill. - **Leaving the residual unowned.** Risk nobody has explicitly accepted is risk that gets re-litigated from zero after every event.