vulnerability

A weakness in a system, application, or process that could be exploited to cause harm. Vulnerabilities can be technical (an unpatched software flaw), procedural (a misconfigured database), or human (susceptibility to phishing). Vulnerability management is the ongoing practice of discovering, prioritizing, and remediating vulnerabilities before they are exploited.

When you'd see it: Security scan reports, penetration test findings, CVE databases, engineering sprint planning.

Why it matters: Unmanaged vulnerabilities are the attack surface. Most successful breaches exploit known, unpatched vulnerabilities rather than zero-day exploits — making patch cadence a fundamental control.

Common mistakes: Conflating vulnerability with exploit. A vulnerability is potential weakness; an exploit is an active attack using that weakness. Not all vulnerabilities are actively exploited.

Related CVE, penetration test, patch management, threat model