A zero-day exploit attacks a vulnerability that is not yet publicly known or patched. Because no signature exists, detection must rely on behavior, such as an unexpected outbound connection or a device running commands it should not, rather than on recognizing the attack itself.
A zero-day removes the option of patching first. What remains is limiting what a compromised device can reach and noticing when it starts behaving differently.
Why prevention is partial
No vendor can patch what it does not know about, and updates take time to reach devices that are seldom touched. Assume some device will be compromised and design the network around that assumption.
Controls that still work
Network segmentation, least privilege, egress filtering and logging of unusual connections all reduce the value of a successful exploit. Keep offline backups so recovery does not depend on the compromised host.
Related:Commercial security camera systemsGlossary: Access control system