The zero-day arithmetic

Microsoft's October 2026 security updates addressed 1,411 vulnerabilities. Three were zero-days. One, tracked as CVE-2026-96951, was being actively exploited. Two had been publicly disclosed before a fix existed.

Any security leader reading that number has the same reaction, and it is not fear. It is fatigue. Nobody patches 1,411 things in a month. So the real work — the work that determines whether you are breached — is deciding which of them matter, in what order, with imperfect information and a change board that meets on Thursdays.

Three clocks, not one

Every vulnerability runs on three clocks, and conflating them is the most common analytical error in vulnerability management.

• The vendor clock. When a fix exists. Publishes on a schedule you do not control.
• The public clock. When the flaw becomes known — through disclosure, patch diffing, or a researcher's publication. After this point, exploitation capability spreads to anyone competent enough to weaponise a diff.
• The adversary clock. When a specific actor starts preparing to use it against a specific target. This clock often starts before the public one, because the actors who find flaws independently do not announce them.

Traditional vulnerability management only sees the first two clocks. The third — the one that actually determines your exposure — is invisible to a scanner.

A CVSS score tells you how bad a flaw could be. It tells you nothing about whether anyone is coming through it, this month, on purpose.

What the Big Sleep case revealed about sequencing

In July 2025, Google's Big Sleep agent found a critical SQLite vulnerability that was known only to threat actors and was about to be exploited. The finding was not accidental brilliance in isolation: Google Threat Intelligence Group had telemetry showing an attack was being prepared, and the agent was directed at the software in question.

That sequence is the lesson. Intelligence established intent; the agent established the specific defect; the fix landed before the exploitation did. Each step depended on the one before it. An agent with no direction would have found something, eventually, somewhere.

What warning actually buys

Pre-exploit warning is not a shield. It is time, and time converts into a small number of very specific actions:

1. Sequence your patching by intent, not severity. If you know a named actor is working a particular class of flaw against your sector, that class goes first — regardless of where it sits in a CVSS-ordered list.
2. Compensate where you cannot patch. The system you cannot touch this month is the one where you need segmentation, monitoring or an access change instead. Warning gives you the weeks required to do that deliberately rather than during an incident.
3. Warn the third party. If a supplier is the access path being prepared, telling them early is cheap and, in most supply-chain incidents, is the only intervention available to you at all.
4. Brief the board with something real. “A named actor is preparing against our sector and we have hardened the two systems they are most likely to use” is a different conversation from a heat map.

Where the intelligence comes from

Adversaries are not silent during preparation. They buy infrastructure, register domains, test tooling, discuss targets, and leave artefacts across criminal ecosystems that are, in aggregate, observable. Zero Day Live, Blackwired's intelligence platform, is built on that premise: a long-running repository of dark-web and illicit-network intelligence, with the tradecraft to distinguish signal from the noise those ecosystems generate.

The value is not the feed. It is the correlation between an external observation and something you own — which is precisely what the Enhanced Attack Surface Management module in ThirdWatch does, mapping direct external threats onto your known vulnerability report in a standardised format.

What it will not do

Two honest limits, because overselling this category is how it gets dismissed.

First, coverage is never total. Some campaigns are prepared in channels nobody can see, by actors who are careful, against targets they have studied. Warning reduces the proportion of attacks that arrive unannounced; it does not eliminate them.

Second, warning without a decision is entertainment. An intelligence programme that produces reports nobody acts on has the same security value as a newspaper subscription. The output has to land in a workflow with an owner and a deadline, or it is noise with better typography.

The question that matters

Not “do we have threat intelligence?” — most organisations do, and most of it is unused. The question is: when intelligence indicates that a specific actor is preparing a specific attack on something we own, what happens next, who owns it, and how fast?

If that question has no answer, you have a subscription. If it has one, you have a capability.

Blueridge advises on threat intelligence programme design, vulnerability prioritisation and pre-exploit warning across the GCC.