IT or security experts can sometimes discover zero-day attacks by scanning internet traffic, examining code, and deploying malware detection technologies. Some zero-day threats bypass these precautions and are discovered by a user who notices that the software program is behaving in a suspicious way. In other cases, a developer may recognize a zero-day vulnerability before the code is released, so an actual attack can be prevented.
Once a zero-day exploit is identified, security solution providers can be alerted to add antivirus signatures and other protections that can help block the new threat.