Google report says 48% of zero-days tracked in 2025 targeted enterprise technologies
The Facts
- Google Threat Intelligence Group (GTIG) tracked 90 zero-day vulnerabilities exploited in the wild in 2025.
- GTIG reported that 43 of the 90 zero-days (48%) targeted enterprise software and appliances/technologies in 2025.
- The report characterized the 2025 enterprise share/volume of zero-days as an all-time high and part of a continued shift toward increased enterprise exploitation first identified in 2024.
- GTIG’s total of 90 zero-days in 2025 was higher than 2024’s 78 but lower than 2023’s 100.
- Google’s report said browser-based exploitation declined to historic lows in 2025.
- The report said security and networking devices and other enterprise infrastructure products (including firewalls, VPNs, and virtualization platforms) were among the top targeted enterprise technologies.
Context
What does Google mean by a “zero-day” in this report?
GTIG defines zero-days as vulnerabilities that are maliciously exploited in the wild before a patch is publicly available (and, as described by TechCrunch, vulnerabilities unknown to the maker at the time they are exploited). therecord.media TechCrunch
How large was the shift toward enterprise targets in 2025?
Google reported that 43 of 90 tracked zero-days in 2025 (48%) affected enterprise technologies—an all-time high share—indicating attackers are increasingly focusing on corporate software and appliances. TheRegister.com IT Security News - … Security Affairs
What kinds of enterprise products were highlighted as targets?
Google said security and networking devices (including firewalls) and platforms such as VPN and virtualization products were among the top targeted enterprise technologies. TechCrunch Security Affairs
The receipts — all 11 sources
Independent coverage (11)
Facts first. Then every angle.
The day’s biggest stories in one short brief — the facts everyone agrees on, then the competing values behind the headlines. Free in your inbox.