Tech Giants Under Siege: 75 Zero-Days Rock Enterprise Security in 2024

At a glance

• Google Threat Intelligence Group (GTIG) tracked 75 zero-day vulnerabilities exploited in the wild in 2024, down from 98 in 2023.
• Microsoft products were hit most often, with Google and Apple also high on the list, alongside enterprise security and networking gear.
• Google’s threat researchers, including the Project Zero team, track and report many of these flaws.
• Attackers are shifting toward enterprise technology: 44% of 2024’s zero-days hit enterprise products, up from 37% the year before.
• Faster patching and better detection on edge devices matter more as that shift continues.

75 zero-days in one year, and a shift toward enterprise gear

Seventy-five. That is how many zero-day vulnerabilities Google Threat Intelligence Group tracked as exploited in the wild during 2024, according to its annual analysis published in April 2025, and while the total was down from 98 in 2023, the mix of targets changed in a way that should worry anyone who runs a corporate network.

Enterprise products are taking more of the hits

A zero-day is a flaw attackers exploit before the vendor has a fix. GTIG found that 33 of the 75, or 44%, went after enterprise technologies, up from 37% in 2023. Twenty of those hit security and networking products such as VPNs and firewalls. Those boxes sit at the edge of the network with high privileges and little monitoring, so a single working exploit can hand an attacker the whole environment.

Who is in the crosshairs

Microsoft still topped the vendor list, largely through Windows, with Google and Apple close behind. Browser and mobile zero-days fell from 2023 as those companies hardened their products. Google’s Project Zero team, which hunts down these bugs and reports them, is part of why. Every fix shortens the attacker’s window.

Google’s analysts frame the goal as closing the gap between when a flaw is found and when it is patched, so users spend less time exposed.

What defenders should change

Edge devices need the same attention as laptops. Patch VPN appliances and firewalls on a short clock and watch them for odd logins or configuration changes.

Detection tools that use machine learning can help spot exploitation that has no signature yet, but they do not replace patching, so treat them as a backstop for the days between disclosure and fix. Patch first.

Why sharing still matters

Zero-days get fixed faster when companies share what they find. One report helps every customer of that product.

Ties between big tech firms and government security agencies help too, and CISA’s Known Exploited Vulnerabilities catalog is the clearest example: it turns those reports into hard patch deadlines that federal agencies have to meet, which in turn pushes vendors and private companies to move faster on the same flaws.

What the 2024 numbers tell security teams

The 2024 numbers are a warning for enterprise defenders. Fewer zero-days overall means little if more of them hit the firewall at the front door. Patch internet-facing security gear first, then check it for signs of compromise.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.