Vulnerability

A vulnerability is a weakness in software, hardware, configuration or processes that an attacker could exploit to gain unauthorized access or cause harm.

Vulnerabilities include software bugs, default passwords left unchanged, misconfigured cloud storage, outdated systems that no longer receive updates and even gaps in procedures, such as no check on payment changes. Publicly known software vulnerabilities are catalogued with CVE identifiers and often given a severity score to help prioritize fixes.

Every organization has vulnerabilities. The goal is to find and fix the most dangerous ones before attackers do. Small businesses are frequently compromised through known vulnerabilities that already had a patch available, especially in internet-facing devices like firewalls, VPNs and email servers.

Practical tip: focus on what is exposed to the internet and what attackers are actively exploiting. Keep an inventory of your hardware and software, replace systems that have reached end of life, apply patches on a regular schedule and run vulnerability scans to catch what slips through. A weakness you know about and track is far less dangerous than one you do not.