The majority of new malware is added to antivirus databases within 24 hours of first appearance. 93 percent is detected within a month, but it can take as long as six months for antivirus to catch the remaining 7 percent. Damballa offers a service that monitors for unusual behaviors, helping enterprises spot files with malicious payloads that have gotten past antivirus software. The service doesn’t report the malware it finds to the antivirus vendors, but individual customers do share the infected files they identify with their antivirus vendor.”]
Source: https://www.csoonline.com/article/2883248/zero-days-last-up-to-six-months-for-some-malware.html