Vulnerability

Vulnerability is the degree to which a system, asset, person, or community is susceptible to harm due to exposure to hazards and to the potential failures of defenses, remedies, and protections. It functions as a component of risk, reflecting how easily adverse events could cause damage given existing conditions.

In information technology and cybersecurity, a vulnerability is a flaw or weakness in software, hardware, or procedures that can be exploited by an attacker to compromise security. Examples include unpatched software, insecure configurations, weak authentication, and known software flaws. Organizations identify vulnerabilities through automated scanners, code reviews, threat modeling, and penetration testing, and manage them through a lifecycle of discovery, prioritization, remediation, and verification. Public vulnerability catalogs such as Common Vulnerabilities and Exposures (CVE) provide identifiers, while scoring systems like the Common Vulnerability Scoring System (CVSS) quantify severity to guide remediation priorities.

In other domains, vulnerability describes the susceptibility of people or communities to harm from hazards such as disasters, disease, or climate change. Factors include age, health, socioeconomic status, geographic location, and access to resources and information. Reducing social vulnerability often involves improving resilience, such as strengthening infrastructure, networks, emergency planning, and social services, and addressing underlying inequalities.

Vulnerability is distinct from exposure and risk. Exposure describes being present in a hazard zone, while risk combines exposure with likelihood and consequences. A vulnerability assessment seeks to identify weaknesses that could increase impact, guiding preventive measures, mitigation strategies, and response planning. Monitoring and periodic reassessment are critical as conditions change.