Zero Days, the eighth novel by British writer Ruth Ware, is a psychological thriller featuring a resourceful, self-reliant female protagonist, Jack Cross. Jack, who narrates the novel, returns home from a routine corporate security job to find her husband, Gabe, brutally murdered. Jack becomes the prime suspect and goes on the run to find the killer. Jack uncovers the cybersecurity threat her husband was murdered to keep secret, a security flaw that allows criminals to harvest personal information about children. Jack learns appearances can deceive but is helped time and again by strangers. In the end, one final surprise gives her a reason to go on when she thought her life had lost its meaning.

This guide refers to the First Scout Press hardcover edition published in June 2023.

Content Warning: The source material features discussions of abuse and stalking and mentions a possible suicide.

Plot Summary

Jack Cross is breaking into an office building in London. With her husband, Gabe Medway, on Bluetooth, she reaches the computer servers and gains access to company records. As she leaves, she is apprehended by security and taken to a police station. She explains that she is a “pen tester” (penetration tester) hired by companies to find security vulnerabilities. She is released when her ex-boyfriend, an officer named Jeff Leadbetter, vouches for her. Jack ended their relationship years ago because of his abuse, but she still fears him.

When she gets home, Jack finds Gabe dead with his throat cut. The hard drive from his computer is missing. Lead detectives Detective Constable Miles and Detective Sergeant Malik suspect Jack. The next day, she calls Gabe’s best friend, Cole Garrick, to tell him what happened. He offers to help find the killer. She then gets an email from Sunsmile Insurance regarding a sizable life insurance policy for Gabe. Jack is now the prime suspect. She didn’t buy the policy, however, and she’s sure Gabe didn’t either. Jack realizes that someone is framing her and flees.

Jack goes home for supplies and to retrieve the keycode to Gabe’s Bitcoin account. Scaling a garden wall to escape an approaching police officer, she punctures her side. Her sister Hel (Helen) brings Jack supplies, including bleach to change the color of her neon-red hair. Jack finds a hostel, but it doesn’t take cash. A friendly man pays for her. That night, she gets a nasty email from Jeff, and she fires back, relating how he abused and stalked her in case others read her reply.

The next morning, Jack meets Cole outside his office at Cerberus Security. He offers her use of his girlfriend’s cabin outside London and sets up a phone so Jack can contact Hel. Jack arrives at the train station with blond hair, Cole’s sunglasses, and his girlfriend’s coat. She uses a sweater to fake a pregnant belly. On the train, a young man gives up his seat for her, another kindness.

The cabin has no heat or electricity, but Jack is safe. She gets a message from an unknown number. It is Hel, who explains that Cole gave her a burner phone too. Jack rationalizes Hel’s uncharacteristic use of emojis and tells her about the insurance policy. The next day, Jack’s phone dies, and Cole shows up, fearing something happened to her. He cooks her dinner, and they drink wine. When Cole says he’s too inebriated to drive, Jack tells him to stay. He kisses her, but she finds herself unattracted to him. Cole cleans the wound in her side; Jack realizes she doesn’t want to tell him about her plan to visit Sunsmile for information about the life insurance policy. They go to sleep, separately.

Jack is awakened by a police radio and sees Malik outside. She jumps out a window and hides until Malik leaves. After finding a diner, she searches the social media accounts of Sunsmile employees until she finds a photo with a security badge and someone who won’t be in the office that day. At a print shop, Jack manufactures a matching badge. Hel texts using an atypical number of exclamation points and is thrilled to hear that Jack is pursuing a lead at Sunsmile. At Sunsmile, Jack finds Gabe’s file along with a recorded phone call about the policy. She recognizes the voice. It isn’t Gabe but rather Cole.

On her way out, Jack spots a group of agitated security guards. She pulls the fire alarm and blends in with the crowd leaving the complex. Jack boards a train and dresses her festering wound in the bathroom. When she gets another message from Hel, she realizes the person she is messaging is not, in fact, her sister. Jack calls Cole and confronts him, saying she knows he took out the insurance policy. Cole tells her Gabe found a security flaw (a zero-day) in a Cerberus app that allows users’ information to be collected without their knowledge. Cole says he told Gabe to report the flaw, but Gabe sold the information on the dark web instead. Cole bought the insurance policy to protect Jack because he thought Gabe might be in danger, and, indeed, he was. Cole says the buyers killed Gabe and stole the information about how to exploit the flaw, which was on his hard drive. Jack sees a woman listening to her conversation, and she fears being recognized. When the train unexpectedly stops, Jack jumps.

Jack contacts the real Hel, who points out the hole in Cole’s story. Gabe would never have sold the information to hackers. However, he definitely would have gone to Cole first. Jack and Hel conclude that Cole knew about or perhaps created the security flaw and that he or the criminals who intend to take advantage of it killed Gabe when he discovered it.

Jack wakes up and vomits because of her infection, she assumes. She believes there must be a backup of Gabe’s work, but to access it, she needs the authentication code that will appear on his phone when she opens his cloud account. The phone is in police custody. She calls Jeff for help, but he double-crosses her and arrests Hel, whom Jack sends to get the code. Jack finds someone online who can route Gabe’s phone number (and thus the two-factor identification code) to a burner phone. With it, she accesses Gabe’s files and finds his plan to notify Cerberus about the security flaw. Malik traces the burner with Gabe’s number, calls Jack, and tries to get her to turn herself in.

Jack opens Gabe’s social media accounts and posts what he discovered about the security flaw. Then, using the phone with Gabe’s number, which will lead the police to her, Jack livestreams herself breaking into Cole’s apartment. She confronts him, and he panics, pulling a gun. He admits to everything and insults Gabe for his unwillingness to take a bribe to keep quiet. The police arrive, and an officer orders Jack to the ground. She passes out.

Jack wakes up in the hospital a day later. Cole has been arrested and will likely go to prison. Jack is no longer a suspect in Gabe’s murder, and she finally cries, which she had been unable to do before. When a nurse enters, he asks her to eat—for the baby. Before emergency surgery, doctors found that Jack was pregnant, unbeknownst to her.

A year later, Jack conducts a pen test at Malik’s station. She gets remarkably far, but Gabe’s mom calls to say that Jack’s daughter, Gabby, is sick. Malik walks Jack out and tells her that Cole killed himself in custody. Furthermore, two bodies were found with DNA matching traces left in her home by Gabe’s murderers. Finally, Malik says Jeff has been fired for his abuse of Jack. Jack goes home to her daughter, smiling through tears.