Glossary · Information security
Vulnerability
A weakness in an asset or control that a threat can exploit to cause harm.
Put the term into practice: ISMS software
What a vulnerability is
A vulnerability is a weakness that makes an asset susceptible to a threat. It might be a missing patch, a weak configuration, an untrained employee, or a gap in a process. Risk arises from the combination of a threat and a vulnerability: a threat with nothing to exploit does no harm, and a weakness nobody targets stays theoretical.
Technical and organisational weaknesses
Technical vulnerabilities in software are published as CVE entries and rated with the Common Vulnerability Scoring System (CVSS) from 0 to 10. Organisational weaknesses have no catalogue: an unclear approval path, shared administrator accounts or a supplier contract without security clauses are found in audits, risk assessments and incidents rather than by a scanner.
Vulnerability management
- Identify: scan systems regularly, subscribe to vendor and CERT advisories, and take over findings from penetration tests and audits.
- Assess: rate each finding by exploitability, exposure and the protection needs of the affected asset, not by the CVSS score alone.
- Treat: patch, reconfigure, isolate, or accept with a documented reason and a deadline.
- Verify: rescan and record the closure so the finding can be shown as handled.
ISO/IEC 27001:2022 Annex A control 8.8 requires the management of technical vulnerabilities, IT-Grundschutz covers it in module OPS.1.1.3 on patch and change management, and NIS2 lists vulnerability handling among the mandatory measures.
