- Google tracked 90 zero-day exploits in 2025
- Enterprise systems are increasingly targeting browsers
- AI expected to speed up attack and defense cycles
Google’s Threat Intelligence Team (GTIG) tracked and helped patch 90 zero-day vulnerabilities that were exploited in real-life attacks in 2025, a new report notes.
While this number is definitely concerning, Google hints that it could rise even more in the coming years, all thanks to AI.
In its report, GTIG states that the 2025 volume is lower than the record of 2023, when the company fixed exactly 100 zero-day bugs, but is higher than the 78 bugs in 2024, leading experts to suggest a “trend towards stabilization at these levels.”
AI on both sides
While the amount of zero-day malware patched has been somewhat consistent over the past half-decade, GTIG’s report suggests things are changing rapidly. For example, there is a “structural change” that began to occur in 2024, towards greater corporate exploitation.
Both in raw numbers (43) and in proportion (48%), the number of vulnerabilities affecting enterprise technology broke records and now account for almost half of all zero-day attacks exploited last year. “We observed a sustained decline in detected browser-based exploitation, which fell to all-time lows, while we observed increased abuse of operating system vulnerabilities,” the researchers added.
In addition to operating system flaws, criminals continue to target security devices and networks, primarily for initial access.
Another major structural change currently occurring is the deployment of AI on both sides of the cybersecurity field. Google expects attackers to use AI to automate and scale attacks by “accelerating reconnaissance, vulnerability discovery, and exploit development.” Since attackers move faster in these phases, defenders will have to adapt or face the consequences.
That adjustment will include tools like agent solutions that can proactively discover and help fix previously unknown security flaws.
“Defenders should prepare for when a compromise occurs, not if it occurs,” Google said, sharing a non-exhaustive set of approaches and guidelines for defending against zero-day exploitation.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds. Be sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp also.
