Security Vulnerability

A security vulnerability is any weakness that could be used to undermine the security of a system. It is one of three linked concepts: a vulnerability is the weakness, a threat is the actor or event that might exploit it, and risk is the combination of how likely exploitation is and how much damage it would cause. Sound security programmes manage all three, but vulnerabilities are where most day-to-day remediation effort is spent.

Vulnerabilities come from several sources. Software defects, such as memory-safety bugs and injection flaws, are introduced during development. Misconfigurations, such as default credentials, over-permissive access or exposed services, are introduced during deployment and operation. Weak or reused credentials, missing patches and insecure design decisions round out the picture. Some vulnerabilities are known and documented; others, called zero-days, are unknown to the vendor and have no fix available.

Publicly known vulnerabilities are catalogued as Common Vulnerabilities and Exposures, each with a unique CVE identifier that lets defenders, vendors and tools refer to the same issue unambiguously. Severity is commonly scored with the Common Vulnerability Scoring System, which rates a vulnerability from zero to ten based on characteristics such as how it can be accessed and its potential impact.

A key operational challenge is that severity is not the same as risk. Tens of thousands of new CVEs are published each year, and a large share are rated high or critical by CVSS, which makes a severity-only list nearly useless for deciding what to fix first. Only a small percentage of vulnerabilities are ever exploited in the wild. This is why modern programmes prioritise using exploitation signals, such as EPSS probability scores and the CISA Known Exploited Vulnerabilities catalogue, alongside severity.

Managing vulnerabilities is a continuous cycle: discover them through scanning and testing, prioritise them by real-world exploitability, remediate through patching or configuration change, and verify that the fix worked. Because the environment and the threat landscape both change constantly, this cycle never truly ends, which is the reasoning behind continuous approaches such as exposure management.

Vulnerabilities are also weighed against exploitability and exposure, not severity alone. A critical vulnerability in an isolated internal system with no reachable path may pose less real risk than a moderate flaw on an internet-facing service with a public exploit. This is the reasoning behind exposure management: rank by the combination of how likely a weakness is to be exploited and how much damage that would cause, rather than by the theoretical severity of the flaw in isolation.

Penetration testing and vulnerability assessment are the practical ways organisations find the vulnerabilities that matter, and prioritisation is how they decide which to fix first. Precursor combines both, ranking findings by real exploitation likelihood so teams spend their effort where attackers actually operate.