You'll need to update that wiki then with your definition. I'll help point you to the places they are wrong:

A zero-day virus (also known as zero-day malware or next-generation malware) is a previously unknown computer virus or other malware for which specific antivirus software signatures are not yet available.

Zero-day protection is the ability to provide protection against zero-day exploits. Since zero-day attacks are generally unknown to the public, it is often difficult to defend against them. Zero-day attacks are often effective against "secure" networks and can remain undetected even after they are launched.

A zero-day (also known as zero-hour or 0-day) vulnerability is a disclosed computer-software vulnerability that hackers can exploit to adversely affect computer programs, data, additional computers or a network.[1] It is known as a "zero-day" because once the flaw becomes known, the software's author has zero days in which to plan and advise any mitigation against its exploitation (for example, by advising workarounds or by issuing patches).

Also I didn't say we were detecting zero-day vulnerabilities for the world, you misread. I was talking about finding evidence of zero-day exploits within our organization. We have however found vulnerabilities with the software we use and have disclosed those vulnerabilities in private.

The links I provided are malware analysis sandboxes, exactly. We can supply files we intercept to those sites and get a play-by-play analysis on what the file does when no engine or heuristic scan picks up on it as malicious. We've run into more than a few that have been completely off the radar of multi-scanners (VT etc) and yet we can see things such as modifications of autoruns and/or odd memory functions.

Anyway, you seem set on pointing out something wrong here when I think you just misread. Yes I know the difference between exploits and payloads (which is the better term to use than just "malware"). I disagree that zero-days are rare...but not every CVE gets an active exploit obviously. I also disagree exploits aren't something we typically use definition lists to stop...once a vulnerability is definable, it can be stopped on the perimeter firewall or via custom definitions....we do these all the time with our Palo Altos and privilege broker.

Anyway, no harm done if this was just a misunderstanding. Hope you see that I'm talking about how we dig through the mess of undefined exploits and payloads that we run into on a daily basis. If you want to get pedantic I can re-write the original post to make it clearer.