Google warns of surge in enterprise zero-day attacks
What happened
Google's Threat Intelligence Group recorded 90 zero-day vulnerabilities exploited in the wild during 2025, up from 78 in 2024. The data points to a continuing shift in attacker focus towards corporate systems. This matters for IT, Telecom & Cyber because contracting activity changes leverage, market appetite, and which clauses buyers can credibly trade with 90, 2025, 78 as the clearest commercial anchors; Breach response SLAs is now more valuable
Buyer takeaway
For IT, Telecom & Cyber, the buyer read-through is commercial leverage: scope, validity windows, reopeners, and term structure may now matter as much as headline pricing
Cost / money
The money issue may come through term structure rather than base price alone, especially if suppliers push for escalation language, shorter validity, or broader pass-through
Supplier / commercial
This is primarily a contracting story: revisit scope boundaries, extension mechanics, and which party carries volatility before those assumptions harden in a live tender
Safety / operations
The main operations question is whether the contract still matches field reality. If scope, response times, or liabilities are vague, the risk usually shows up during execution
What to watch
Watch scope creep, liability pushback, and term changes that move volatility back onto the buyer even if the base rate looks manageable
Key facts
- Google's Threat Intelligence Group recorded 90 zero-day vulnerabilities exploited in the wild
- The data points to a continuing shift in attacker focus towards corporate systems
- Google identified 43 zero-days affecting enterprise software and appliances, or 48% of all tr
- Browser exploitation continued to decline, with browser-related zero-days falling to less tha
