Disclosure day is the date when a vulnerability becomes publicly known, usually through a CVE entry or a coordinated security announcement. It is a visibility milestone, not proof that the flaw is new or that exploitation has not already begun.
This term matters because defenders often use public disclosure to trigger patching, detection, and asset review. In modern attacks, however, threat actors may already be probing or exploiting a flaw before disclosure day arrives. That makes disclosure a lagging indicator in some cases. Good defense therefore combines vulnerability intelligence, exposure management, and prioritization of internet-facing or hard-to-patch systems, rather than waiting for public notice alone.