A vulnerability is any weakness in software, hardware, process, or configuration that someone could misuse to cause harm or gain access.
It is the condition itself, not the scanner that lists it and not the program that tracks the fix.
How it works
The weakness may be a code flaw, an open management port, or a process that lets one person change a bank account alone.
Severity depends on exposure and on what would break if it were misused.
The same flaw on an isolated test machine is not the same event as on a public payment system.
Assessment ranks findings, scanning discovers many of them, and management drives them to a fix.
Concrete examples
- An unlocked management port is a weakness even before a named bug is attached to it.
- A process that lets one employee change a supplier bank account alone is a process weakness.
- A missing patch on a server is a software weakness inside this broader idea.
Protective measures
- Describe each weakness in plain language that says where it sits.
- Rank by exposure and impact in your environment, not by rumor.
- Assign an owner who can change the system or the process.
- Do not stop when a tool has printed a list and nobody owns the next step.