Earlier this week the head of the NSA's Tailored Access Operations unit rather remarkably gave a presentation at the USENIX Enigma security conference. (News coverege here and here; video of the talk here). The topic of the talk: how to defend against sophisticated, persistent, nation-state-level attackers, like, well, the TAO. As one might expect, there were no jaw-dropping revelations of classified, novel techniques for hacking or defense. But the TAO chief nonetheless made at least a few thought-provoking points. One of them was about the NSA's use of zero-day exploits. Or, actually, the uncommonness thereof:
“A lot of people think that nation states are running their operations on zero days, but it’s not that common,” he said. “For big corporate networks persistence and focus will get you in without a zero day; there are so many more vectors that are easier, less risky, and more productive.”
One might be suspicious, on any number of grounds, that the head of the NSA's hackers could simply be understating the role of using zero-days in these obviously classified operations. And obviously, there have been any number of documented nation-state operations in recent years that have used zero-days. (None more extensively than Stuxnet attacks orchestrated in large part by, yes, the NSA.) Still, even if the degree of his dismissiveness was a little bit "thou doth protest too much", I've definitely read and heard similar things from other sources recently sounding similar themes. (Like this article, and this presentation at Defcon last month.) And, incidentally, the rest of the talk was pretty persuasive that NSA hackers are adept at finding and getting in through cracks in a target's defenses without needing to resort to zero-days.
(Edit: To clarify, for this question I take "zero-day" to mean a vulnerability and accompanying exploit the existence of which are unknown to the defender and to general infosec community when they are used in an attack.)
So, the question: anybody know of any info--from statistics of some kind, anecdotes of personal experience, whatever you think significant--that speaks to how often sophisticated attackers who have access to zero-days--in other words, basically nation-states actually resort to using them in attacks?