Zero-Day Attacks and Zero Trust Architecture: A Critical Comparative Review

الملخص

Because zero-day attacks take advantage of undiscovered, undeclared, or unpatched vulnerabilities before trustworthy signatures, patches, or mitigation rules become available, they continue to be one of the most significant concerns in contemporary cybersecurity. Simultaneously, cloud, remote work, Internet of Things, and hybrid enterprise environments are becoming more and more inadequate for conventional perimeter-based security methods. Zero Trust Architecture is a security paradigm that substitutes policy-based access control, least privilege, micro-segmentation, and continuous verification for implicit trust. This study uses an IMRaD-based framework backed by an Evidence and Reliability Protocol and a PRISMA-informed approach to critically compare zero-day attacks with Zero Trust Architecture. Zero-day detection, machine learning-based intrusion detection, benchmark datasets, Zero Trust principles, migration issues, and cyber-resilience tactics are all included in this review. The results show that because Zero Trust does not eliminate unknown vulnerabilities, it cannot completely prevent zero-day exploitation. On the other hand, it can lessen the attack surface, restrict lateral movement, limit privilege escalation, increase visibility, and lessen the consequences of a compromise. Key gaps are also identified by the review, such as the lack of standardized benchmarks for assessing Zero Trust's efficacy against zero-day attack chains, fragmented Zero Trust implementation models, poor integration between anomaly detection and policy enforcement, and limited real-world validation. Adaptive Zero Trust architectures that incorporate explainable intrusion detection, dynamic risk assessment, Moving Target Defense, and human-in-the-loop decision support should be the main emphasis of future study.