4 Vulnerabilities and Risk
Learn how vulnerabilities create potential harm, how severity, exploitability, and exposure shape organizational risk, and how to assess, prioritize, and respond to findings.
What a means
A is a weakness in a system, its implementation, or its security procedures that a threat source could exploit or trigger. Examples include unpatched software, weak access controls, exposed services, and insecure configurations. A creates a possibility of harm; it does not, by itself, mean that a system has been compromised.
and
describes a 's potential technical impact. The Common Scoring System () provides a standardized way to express that . Base metrics consider characteristics such as how an attacker can reach the flaw, what privileges or user interaction are required, and the possible effects on confidentiality, integrity, and availability. Threat and Environmental metrics can add information about exploitation activity and the importance or configuration of the affected system. A score is useful for comparison, but it is not a complete measure of in every organization.
concerns how feasible it is for an attacker to use a . Relevant factors include whether an attack can be launched remotely, whether authentication or special conditions are required, whether a user must take an action, and whether reliable exploit code is available or exploitation is already occurring. A that is easy to exploit and actively targeted generally needs urgent attention.
in organizational context
combines the chance of a threat exploiting a with the consequences for the affected organization. Consequences depend on the asset and its role: a flaw in a public-facing system holding sensitive data may be more consequential than the same flaw on an isolated test machine.
In practice, decisions consider technical alongside , , asset criticality, safeguards, and business impact. A score alone therefore does not establish how important a is to a particular organization.
How affects
describes how reachable or accessible a vulnerable asset is to potential attackers. An internet-facing service is typically more exposed than a device on a restricted internal network. can also increase when a vulnerable application is widely deployed, accessible to many users, or connected to sensitive systems.
Network segmentation, access restrictions, and disabling an unnecessary service can reduce or limit potential harm. These controls may not remove the underlying .
Assessing vulnerabilities
A identifies and evaluates weaknesses in systems and networks. It commonly involves maintaining an asset and software inventory, scanning for known issues or unsafe configurations, checking results against reliable information, and validating important findings.
Scanners can produce false positives or miss issues, so findings should be reviewed in context. Technical assessment methods include scanning and techniques for validating findings.
Prioritizing findings
Prioritization helps direct limited resources toward vulnerabilities most likely to cause serious harm. Consider the following factors together:
and likely impact: Determine what an attacker could affect, including confidentiality, integrity, availability, safety, or essential operations.
and threat evidence: Consider whether exploitation is technically straightforward, whether usable exploit code exists, and whether there is evidence of active exploitation.
: Determine whether attackers can reach the affected system and what safeguards limit access.
Asset importance and scope: Consider how critical the system is, what data or services it supports, and how many affected instances exist.
Available response: Determine whether the organization can patch promptly or should first reduce using temporary controls.
Applying -based priorities
Two vulnerabilities might both have high but merit different response speeds. If one affects an internet-facing business system and is known to be actively exploited, while the other is present only on an isolated machine with no sensitive data, the first would usually be prioritized for faster action.
The CISA Known Exploited Vulnerabilities (KEV) Catalog is one source of evidence that a has been exploited in the wild. It supports prioritization but does not replace assessment of an organization's own systems and .
Responding and reassessing
After prioritizing a finding, an organization may it by applying a patch or changing the affected system. Alternatively, it may it temporarily by limiting access, isolating the asset, or disabling the vulnerable feature.
Teams should verify that the fix or mitigation worked and reassess as systems and threats change. Patch management includes identifying, prioritizing, acquiring, installing, and verifying updates.
Putting the concepts together
estimates potential technical impact; describes how feasible an attack is; describes how reachable the vulnerable asset is; and depends on these factors in the context of the organization and its assets. assessments find and evaluate weaknesses, while -based prioritization helps direct resources toward the vulnerabilities most likely to cause serious harm.