Zero-day exploits pose a challenge to critical infrastructure, as defenders must detect malicious behaviour prior to the existence of a reliable signature, patch, or complete threat profile. This problem is particularly acute in Saudi Arabia where energy, water, transportation, telecommunications, healthcare, government, and smart-city services rely on tightly coupled information technology and operational technology. This review summarises recent evidence about three capabilities that determine whether an unknown exploit becomes a contained security event or a cascading service disruption: advanced detection, rapid containment, and coordinated incident response. The researchers undertook a structured integrative review of the DOI-verified literature, from 2020 to 2025, focusing on zero-day detection, industrial control systems, cyber-physical resilience, zero-trust containment, explainable artificial intelligence, federated learning, security orchestration, and recovery. Thirty sources were included in the thematic synthesis. The evidence suggests that no single detector is robust enough to detect unseen attacks. The combination of behaviour baselining, unsupervised or semi-supervised learning, explainable scoring, asset and process context and cross-domain telemetry leads to greater resilience. Detection must then link to safety-aware containment, including identity restriction, micro segmentation, endpoint or workload isolation, and carefully bounded operational-technology actions. Orchestration and automation enable rapid response, but control actions with high consequences require human authorisation and predefined fallback states. The review introduces a Saudi Zero-Day Cyber Resilience Framework that connects detection confidence, operational criticality, containment authority, response playbooks, validation of recovery, and post-incident learning. The framework shifts the focus from perfect prevention to measurable continuity, controlled degradation and faster restoration under uncertainty. It also discusses research directions in local industrial datasets, adversarial robust models, digital-twin validation, privacy-preserving collaboration, and resilience metrics applicable to the Saudi critical infrastructure.