The Zero-Day Inversion

Discovery and remediation run on different clocks

A newly disclosed vulnerability starts at least two clocks.

Attackers begin adapting the technique. Defenders begin identifying exposure, analysing dependencies, testing a fix, scheduling change and preparing rollback. In OT, the process may also require safety review, engineering approval and an outage window.

The permanent answer may be obvious and still be unavailable immediately. Patch the application. Upgrade the controller. Replace the component. Reconfigure the service. Remove the end-of-life asset.

The gap between knowing and fixing is where exposure persists.

Conventional controls can help but they often operate at a different level. A firewall can close a port and interrupt the service. A detection tool can recognise suspicious behaviour but still allow the interaction to reach the application. An emergency code change can solve the problem but inherit the release risk of the system it modifies.

The best protection loop accepts many forms of intelligence

Cyber knowledge no longer arrives through one channel.

An official agency may publish an active exploitation warning. A university researcher may describe a new attack technique. An internal SOC may observe a pattern in telemetry. An EDR platform may identify suspicious behaviour. A frontier model may connect a new disclosure to an enterprise asset more quickly than a human analyst could read every source manually.

These inputs have different provenance and confidence. They should not be flattened into one autonomous instruction.

They can, however, enter one governed process. Identify the affected interaction. Translate the finding into a candidate policy. Prove the policy against legitimate and malicious traffic. Obtain the required authority. Deploy in controlled scope. Observe the result. Retire or retain the control when the permanent remediation is complete.

The research problem is therefore not threat-intelligence collection. It is translation from trustworthy knowledge to executable protection.

Data Mediation separates the source of knowledge from the point of enforcement

Data Mediation provides a stable enforcement architecture while the intelligence source and vulnerability change.

A Programmable Data Agent sits in the authorised interaction path. It understands the relevant protocol and can apply an explicit rule before the request or response completes. The rule may block a malicious message shape, add a required response header, restrict a command, mask a field, limit a rate, require an additional approval or redirect the interaction to a safer path.

The target system does not need to understand why the new control exists. It continues receiving the interactions it is permitted to receive.

This is where the Zero-Day Inversion begins. The organisation stops waiting for every system to become patchable before it can act on newly discovered risk.

A self-protection flywheel can remain customer-controlled

The term self-protection can imply an autonomous system changing production controls without human authority. That is not the model proposed here.

The flywheel separates assistance, judgement and enforcement.

Research, alerts, telemetry and AI can accelerate identification. The platform can assist with asset mapping, control composition and test generation. Cyber, application and risk teams validate the proposed behaviour. OT changes add the required operator, engineering and safety authority. The deployed policy is deterministic, versioned, observable and reversible.

Evidence from the deployed control then becomes another input. Was legitimate traffic affected? Did malicious attempts continue? Did the rule match the expected protocol behaviour? Is the permanent fix now available? The next policy can be better because the previous one produced operational evidence rather than only an alert.

This creates a protection loop rather than an information loop.

Published web research can become an immediate interaction control

Frame-busting research provides a simple example of the translation.

Security researchers have long studied how a malicious site can frame another application and manipulate the user into interacting with content they do not realise they are controlling. Modern browser policy provides a stronger defence through Content Security Policy, including the frame-ancestors directive.

If an application cannot be changed immediately, the relevant response header can be introduced at the mediated boundary. Legitimate framing origins can be defined. Disallowed framing is blocked by the browser. The application code remains unchanged while its outward security behaviour changes.

The important point is not this one web technique. It is the operating method. A research finding describes an unsafe interaction. The finding is translated into an explicit protocol control. The control is tested, approved and introduced at the boundary. Evidence is collected while the application team completes the permanent work.

The same method can apply to other HTTP, database, terminal, messaging and file-transfer interactions where the unsafe condition can be expressed deterministically.

Current OT warnings show the same pattern in physical infrastructure

In July 2026 the FBI and US Environmental Protection Agency warned that malicious actors were targeting internet-facing PLCs used by water and wastewater utilities. Reported effects included loss of monitoring and control, changed configuration and operational disruption.

The recommended mitigations were direct and practical: remove PLCs from public internet exposure, broker remote access through secure gateways, use strong authentication, restrict communications, enable logging, validate project files, maintain manual operating capability and isolate or replace end-of-life equipment.

These recommendations are not a product endorsement and Data Mediation is not a substitute for them. They illustrate the architectural problem the paper is addressing. A controller may need a safer interaction boundary now even though replacement, redesign or native hardening will take longer.

A mediated path can contribute where the engineering case supports it: broker the authorised remote session, restrict the target and permitted function, record the interaction, deny unexpected peers and make isolation simpler by reducing uncontrolled connectivity.

The same logic appears in Australia’s CI Fortify guidance. Critical infrastructure operators are encouraged to identify vital OT and enabling systems, design isolation points and maintain the ability to isolate those systems for extended periods while critical services continue. The fewer implicit paths a system depends on, the more practical that resilience becomes.

The real outcome is controlled time for permanent remediation

Zero-day prevention should not become an excuse to avoid patching, replacement or engineering change.

Its value is controlled time.

An application team can complete regression testing without leaving the known exploit path open. An OT operator can wait for the correct maintenance window while an unsafe remote interaction is constrained. A vendor can prepare an upgrade while the organisation keeps evidence of every attempt against the temporary control.

The same platform capability can later be retired, retained as defence in depth or adapted for the next risk. The underlying investment is therefore not a one-off virtual patch. It is the governed mechanism that turns validated knowledge into policy at the interaction point.

This is also where frontier models become useful without becoming authoritative. They can read advisories, compare asset inventories, suggest candidate rules and generate tests at machine speed. Human and engineering authorities still decide whether the rule is correct. The PDA enforces only the policy that has been approved.

The inversion is from remediation time to protection time

Cybersecurity has invested heavily in seeing risk earlier. That value is diluted when every new finding still waits for the release cycle of the system it exposes.

Data Mediation creates another route. The vulnerable application or device can remain responsible for its existing function while a new control is placed in the interaction path. Intelligence from agencies, researchers, internal systems and AI can be translated into a candidate policy. The customer proves and approves it. Deterministic enforcement begins. Permanent remediation continues on the correct timetable.

The Zero-Day Inversion is not autonomous judgement. It is the compression of the time between trusted knowledge and controlled protection.