National Security Agency: The Silence of the Zero Days: US Defense Department Defenders Say Attackers Don’t Need No Stinking Zero Days. “Within 24 hours of a vulnerability or exploit being released, it’s weaponized and used against us,” says NSA’s David Hogue. Hogue: “NSA has not responded to an [unclassified network] intrusion that has used a zero-day [exploit] in the last 24 months” The majority of incidents involved email-borne attacks – in 90 percent of all cases – and attempts to exploit systems that are not compliant with hardware and software best practices.”]
Source: https://www.cuinfosecurity.com/blogs/nsa-silence-zero-days-p-2623