Takes place before the security community or software developer  
 knows about  the vulnerability or has been able to fix it 



.