Vulnerability
A weakness in a system, process or control that could be exploited by a threat actor to compromise confidentiality, integrity or availability.
Full Definition
Vulnerabilities include software defects (unpatched CVEs), misconfigurations (open security groups, overbroad IAM), weak cryptography (deprecated TLS versions, weak keys), authentication gaps (missing MFA, default credentials), supply-chain weaknesses (vulnerable transitive dependencies) and process gaps (missing joiner-mover-leaver automation). Each vulnerability is a potential breach channel; the Common Vulnerability Scoring System (CVSS) rates software vulnerabilities on a 0–10 scale that factors in exploitability, impact and existence of exploits in the wild.
A vulnerability-management programme discovers vulnerabilities continuously (SAST, DAST, SCA, cloud scanning, bug bounty), prioritises them (CVSS plus exploitability-in-the-wild via EPSS and KEV data), tracks remediation SLAs by severity, and reports residual risk. GDPR Article 32, DPDP Section 8(5), PDPA, PCI DSS and SOC 2 all require regular vulnerability assessment. Unpatched high-severity vulnerabilities in internet-facing services are consistently among the top root causes in breach reporting.
Related terms
Misconfiguration
A security weakness caused by incorrect or insecure settings in a system, service or cloud resource.
Incident Response
The structured process by which an organisation detects, triages, contains, remediates and learns from a security or privacy incident.
Data Breach
A security incident in which personal data is accessed, disclosed, altered, destroyed or lost without authorisation.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes