Ethiack Launches Free 'Zero' Platform to Combat Rapidly Shrinking Cyber Vulnerability Windows

European cybersecurity firm Ethiack has launched Ethiack Zero, a free platform designed to identify exploitable software vulnerabilities before they receive official CVE listings. For fintechs managing sensitive data, this reduces the "Time-to-Exploit" gap, providing a real-time feed of validated threats to help security teams prioritize patches before attackers can strike.

What was announced

Ethiack Zero is a public platform and API that tracks vulnerabilities from their earliest signals, including security advisories, patch announcements, and blog posts. Unlike traditional databases that wait for a formal Common Vulnerabilities and Exposures (CVE) designation, this tool validates whether a flaw is actually exploitable in real-time. The launch follows a significant security event where the UK Government took 32 online services offline as a precaution due to critical vulnerabilities in PHP, a programming language powering 70% of global websites. The internet infrastructure platform Cloudflare reported millions of hacking attempts within hours of that discovery.

The platform aims to combat the shrinking window for defense. Data from Mandiant indicates that the mean Time-to-Exploit (TTE)—the duration between a vulnerability being publicly disclosed and its first observed exploitation—has dropped from 63 days in 2018 to minus seven days today. This means exploitation often begins a full week before public disclosure. Ethiack Zero provides a timestamped public feed of these "Zero Day" threats as they emerge. While it validates exploitability to help teams filter out noise, it does not publish the specific exploit details, focusing instead on providing evidence for response prioritization. The service is free for the cybersecurity community, offering both a web-based feed and API access for researchers and defenders.

"For years, the publication of a CVE was effectively the starting gun for security teams. But that starting gun has moved."

Jorge Monteiro, CEO and co-founder of Ethiack

The companies involved

Ethiack is a European cybersecurity firm that specializes in identifying and validating software vulnerabilities. The company is led by CEO and co-founder Jorge Monteiro. As a player in the proactive security space, Ethiack focuses on the early stages of the vulnerability lifecycle, aiming to provide tools that allow defenders to act before official administrative processes, such as the assignment of a CVE, are completed.

The firm operates in a market where the speed of exploitation is rapidly outpacing traditional security protocols. By launching Ethiack Zero as a free public platform, the company is positioning itself as a contributor to the wider cybersecurity community, providing open access to its validation data via a public feed and API. This approach targets the gap between the discovery of a flaw and its formal disclosure, a period where organizations are often most vulnerable. Ethiack’s focus on "Zero Day" vulnerabilities and real-time validation reflects a broader industry move toward automated, signal-based defense mechanisms designed to handle the scale of modern hacking attempts seen on global networks.

What this means

The transition to a "minus seven day" exploitation window signals a fundamental breakdown in the traditional vulnerability management lifecycle. When attackers consistently exploit flaws a week before public disclosure, the official CVE system becomes a historical record rather than a defensive tool. Ethiack’s entry into real-time validation puts pressure on traditional threat intelligence providers to move faster and reduce false positives. For the fintech industry, which relies on the security of ubiquitous languages like PHP, the ability to distinguish between a theoretical flaw and a validated exploit is critical for resource allocation. This announcement highlights a shift toward decentralized, community-driven security signals as the primary line of defense against automated, large-scale exploitation attempts.