i understand what zero day protection is, however if you have 1000 machines well behind firewalls, honey pots etc running your entire business, chances of even zero day exploit affecting them are marginal. Risk of this kind of screw up is much higher then non-internet exposed machines being affected.
In reality, there should be "urgent zero day" patch application as totally separate process for other patches that should be delayed by large companies. I'm willing to bet this particular update had no zero day protections in it...
It's all about layers. You never assume any layer is perfect, so a failure to detect in one layer is picked up by another.
Crowdstrike does it's analysis in the cloud, and nor is it a signature based scanner (it can do it, but that feature only came out recently, as in last few months). So sensor patches are usually things other zero day patches.
