Everyone fears the zero-day exploit. But old, unpatched vulnerabilities still provide the means for malicious hackers to carry out the vast majority of hacks
http://www.infoworld.com/article/3075830/security/zero-days-arent-the-problem-patches-are.html
Fear of the zero-day exploit
Zero-days, where an attacker exploits a previously unknown vulnerability to attack a customer, aren't even the majority of bugs found. According to the most recent Microsoft Security Intelligence Report, around 6,300 unique vulnerabilities appeared in 2015. Symantec says that only 54 of them were classified as zero-days, a little less than 1 percent.