Study Guide
Vulnerabilities and Exposure
What makes a system weak, what makes it reachable, and how defenders find out about both: zero-days, the NVD, Shodan, breached data and staying informed.
Lesson 2.3 Threats, Vulnerabilities & Defence
The Attack Chain showed attackers moving from one opportunity to the next. This lesson asks where many of those opportunities come from, and how defenders keep finding out about new ones.
Stage: Think
Two broken locks
Two houses each have a back door whose lock is broken. One door opens onto a busy public footpath. The other opens onto a walled garden that only the family can get into.
Think it through
Show the answer
Answer: C. The footpath door: anyone passing can reach it.
The weakness is identical. What differs is who can reach it. Those are two separate questions: is it weak, and who can get to it?
Think it through
The walled-garden lock is less urgent. How might it still end up being used?
- Hint 1: Who is already inside the garden?
- Hint 2: What if the garden gate is left open one day?
Show what happens
Someone already in the garden could use it, a gate could be left open, or the wall could change. Reachability is not fixed, so the hidden weakness still needs fixing, just less urgently.
Stage: Explain
Weakness and reachability are different questions
Vulnerabilities take many forms. A flaw in software is the obvious one, but a default password left unchanged, an administration page left open or a process that lets anyone reset an account are vulnerabilities too. Exposure asks something different: who can find and reach the weakness?
Separating the two questions changes what you do next. A serious flaw in a system that only a few staff can reach is still important, but it is less immediately exploitable than the same flaw in a service anyone on the internet can connect to.
Two independent questions about the same system, showing the potential opportunity for exploitation. It is not a complete risk rating.
Reachable by others
Not reachable by others
Known weakness
Known weakness · reachable
Greatest opportunity
Anyone who finds the system could try to exploit the weakness. Fix or remove it first; reduce exposure while you do.
Known weakness · not reachable
Latent weakness
Harder to reach today, but an insider, a stolen account or a change in configuration could expose it. Still plan the fix.
No known weakness
No known weakness · reachable
Exposed but not known to be weak
Nothing known is wrong, but every exposed service is something to monitor and keep updated. Ask whether it needs to be reachable at all.
No known weakness · not reachable
Lowest immediate opportunity
Not a guarantee: new weaknesses are discovered, and reachability can change.
The matrix shows where an attacker has a potential opportunity, not how much risk there is. Actual risk also depends on how capable and motivated a threat actor is, how important the asset is, what the impact would be and which controls are already in place.
Check your understanding
Show the answer
Answer: A. Latent weakness: weak, but harder to reach today.
It is a latent weakness: weak, but not widely reachable. A stolen account or a change in configuration could still expose it, so the fix is planned rather than dropped.
This connects to risk. One model is Risk = Threat × Vulnerability × Asset, and another is Cyber Risk = Impact × Probability. The multiplication signs are a way of saying “depends on all of these together”; neither is a sum to work out with numbers. The point of both is the same: a vulnerability on its own does not tell you how much risk there is. How important the affected asset is, how likely exploitation is and what the consequences would be all matter. The Risk lesson develops this.
Stage: Predict
Exposure: what can others see and reach?
Think it through
Show the answer
Answer: B. Yes: devices that answer the internet can be found by searching.
Yes. Services contact internet addresses in bulk, record what answers and make the results searchable, as described below.
Many devices are connected to the internet without anyone deciding that they should be reachable by the whole world. Shodan is a search engine that indexes internet-connected devices and services. It can reveal publicly accessible servers, networking equipment, IoT devices and other exposed services. Its results can include internet-connected webcams, which shows the real-world consequences of insecure configuration.
A simplified explanation of how internet search engines for devices work, one stage at a time, saying who acts at each.
The device
Step 1 of 4: A service is reachable
A device answers connections from the internet, for example a camera’s web interface.
A scanning service
Step 2 of 4: It is contacted
Internet-wide scanning connects to many addresses and records what each service reveals, such as its product name and version.
The search engine
Step 3 of 4: It is indexed
The responses are stored and made searchable by product, port, location or organisation.
Anyone
Step 4 of 4: Anyone can search
A defender can find their own forgotten devices; an attacker can look for devices running a version with a known weakness.
FOFA is a comparable search engine for internet-facing systems. The lesson from all of these tools is the same: configure internet-connected devices securely, reduce unnecessary exposure, and understand which services can be reached from outside the organisation.
- The set-up. A small office installs a camera and enables remote viewing so the manager can check it from home. The router is configured to forward outside connections to the camera. The default password is never changed.
- Exposure. The camera’s login page is now reachable by anyone on the internet, not only by the manager.
- Discoverability. Scanning records the camera’s web page, including its product name. It becomes searchable in services like Shodan.
- Vulnerability. The unchanged default password is a weakness. If that product version also has a published flaw, there is a second one.
- Opportunity. Exposure plus weakness now puts the camera in the “greatest opportunity” corner of the exposure matrix.
- Defensive response. Remove the forwarding rule if remote viewing is not essential, or provide it through a more controlled route. Change the default password, update the firmware (the software built into the camera) and add the camera to the office’s list of devices so it is not forgotten again.
What the example shows: the default password was a weakness from the day the camera was installed. It became an opportunity for an attacker only when the forwarding rule made the camera reachable. Weakness and reachability are separate facts, and the danger is in the combination.
Stage: Predict
Zero-day vulnerabilities
Think it through
Show the answer
Answer: C. Nobody has told the app’s maker about it yet.
When the maker does not know, defenders have had no time at all: no warning, no fix and no workaround. That situation has a name, and the terms around it are easy to confuse.
A zero-day vulnerability is often defined as a security weakness that is unknown to the vendor, or does not yet have an available fix, when it becomes exploitable. That is the broad usage, common in introductory and exam material. Professional sources often use the term more narrowly, so both usages are set out here.
The name refers to defenders having had zero days to prepare a fix. That broad definition is a useful simplification. In professional usage the term is narrower: a vulnerability is a zero-day because the vendor does not yet know about it, not simply because no fix is available. Three related terms are worth keeping apart:
- Zero-day vulnerability: a flaw the vendor is not yet aware of, so no fix has been developed. Defenders have had no time to respond.
- Known, unpatched vulnerability: a flaw that has been disclosed or is known to the vendor, but that is not yet fixed on a particular system. A fix may not exist yet, or it may exist and not have been applied. This is not a zero-day, even though the system is still vulnerable.
- Zero-day exploit: the code or technique that takes advantage of a zero-day vulnerability. Using one is sometimes called a zero-day attack.
Why sources differ. The two usages agree at both ends and differ only in the middle:
- Nobody has told the vendor. A zero-day in every source.
- Disclosed, but no fix exists yet. The broad usage still says zero-day, because defenders have nothing to install. The narrower usage says known, unpatched vulnerability, because the vendor and defenders now know and can respond in other ways.
- A fix has been released but not installed. Not a zero-day in any source.
When you read a report or answer a question, work out which of the three situations is described. Wording such as “unknown to the vendor” or “no patch is available” usually points to zero-day. “A patch was released but has not been applied” never does. This lesson and Risk use the narrower terms from here on, and say so.
Check your understanding
Show the answer
Answer: B. A zero-day exploit.
The flaw is a zero-day vulnerability, because the vendor does not know about it. The code or technique that uses it is a zero-day exploit.
A simplified, typical lifecycle, one stage at a time. The dangerous periods are before a fix exists and between its release and its installation.
Nobody yet
Step 1 of 5: The flaw exists
A weakness is present in the software, usually unknown to everyone.
A researcher, the vendor or an attacker
Step 2 of 5: Someone discovers it
While the vendor does not know about it, it is a zero-day, and an attacker using it is using a zero-day exploit.
The vendor
Step 3 of 5: It is disclosed
The vendor learns of it and it may be published, often with an identifier and a severity rating. From here it is a known vulnerability in the narrower usage, even if no fix exists yet; the broad usage still says zero-day until one does.
The vendor
Step 4 of 5: A fix is released
The vendor publishes a patch or other remedy.
Each organisation
Step 5 of 5: The fix is applied
Each organisation still has to install it. Until then, its systems remain vulnerable to a weakness that is now publicly known.
Real vulnerabilities do not all follow this sequence. Some are published before the vendor has a fix; some are handled with a configuration change or other workaround rather than a software patch; and some, in products no longer supported, are never fixed at all.
The last stage is easy to overlook. Releasing a fix and applying it are different events. Once a vulnerability is known it is no longer a zero-day, but every system that has not yet been updated or otherwise protected is still exposed, and details of the flaw are now public. That is why patching needs to be timely and prioritised.
An analogy helps: imagine discovering that a bank had accidentally left a door unsecured. Someone who notices could report it so it can be fixed, or could try to take advantage of it. The conclusion is clear: discovering a weakness does not give permission to exploit it. Authorisation and ethical conduct remain essential when investigating vulnerabilities, a point Attack Chain also makes about security testing.
Stage: Explain
Looking up known vulnerabilities: the NVD
The National Vulnerability Database (NVD), maintained by NIST, provides information about publicly disclosed vulnerabilities.
Three different things are often mentioned together:
- CVE is an identifier. A CVE ID, in the form CVE-year-number, gives one publicly disclosed vulnerability a single name so that vendors, researchers and defenders can refer to the same flaw. IDs are assigned by authorised organisations, including many vendors. Not every disclosed vulnerability receives one.
- CVSS is a technical severity score. It rates a vulnerability from 0 to 10 based on its characteristics, such as how it can be exploited and what it could affect. It knows nothing about any particular organisation.
- Risk is a separate, organisation-specific assessment. It combines the technical severity with exposure, the importance of the affected asset, the likely threat and the controls already in place. The Assessing Risk lesson explains why the same CVSS score can mean very different business risk.
The NVD is built on CVE records and adds analysis, which can include a description, the affected products and versions, a CVSS score and links to vendor advisories and fixes. That analysis is not always immediate, so a recently published record may not yet have an NVD score.
Continue with the fictional office camera from the exposure step.
- Know what you have. Record the camera’s make, model and firmware version. You cannot look up weaknesses in a device you do not know about.
- Search. Look up the product in the NVD or the vendor’s security advisories.
- Read the entry. Suppose a record describes a flaw allowing login without a password in firmware versions before 2.4, with a CVSS base score in the critical range. The camera runs version 2.1, so it is affected. The record’s CVE ID identifies the flaw; the CVSS score describes its technical severity.
- Assess the organisation’s risk. The camera is internet-facing (high exposure), but it shows only an empty storeroom (a lower-value asset). Both facts feed the office’s own priority decision; the severity score alone does not settle it.
- Act. Apply the vendor’s fix, and reduce exposure while waiting if the fix cannot be applied straight away.
The vulnerability, its record, the score, the version numbers and the camera are all invented for this example; no real CVE or advisory is described.
Check your understanding
Show the answer
Answer: C. Which flaw it is, by a shared name.
A CVE ID only names the flaw. CVSS rates its technical severity, and the office’s own risk assessment decides how urgent it is there.
Stage: Predict
Breached data and exposed credentials
Think it through
Your email address and an old password appear in a breach of a shopping site you used years ago. Why might that matter for your work account?
- Hint 1: Have you ever used the same password in more than one place?
- Hint 2: What would someone with that list try next?
Show what happens
If the same password was used anywhere else, anyone with the breached list can try it there: no phishing needed. That is why breached data matters to organisations, not only to the site that was breached.
Exposure is not only about devices. When organisations suffer breaches, information such as email addresses and passwords can end up circulating. Services associated with breached data include Have I Been Pwned, DeHashed and BreachDirectory. They show how information exposed through poor configuration or data breaches can potentially be discovered by third parties.
- Why this matters: people often reuse passwords. A password leaked from one service may let an attacker sign in somewhere else, which is the credential theft stage of an attack reached without any phishing at all.
- Have I Been Pwned lets someone check whether their own email address appears in known breaches, so they can change affected passwords. Other breach-search services can reveal far more, including the leaked data itself.
- Use them responsibly: check only your own accounts, or organisational accounts when you are authorised to. Treat anything found as sensitive information, and follow the law and your organisation’s policies. Being able to search for someone’s data does not make it appropriate to do so.
Stage: Explain
Staying informed
Significant UK breaches illustrate the idea that every company is one mistake away from being breached: even well-resourced organisations can be affected by a single mistake, an overlooked vulnerability or a successful attack. Because weaknesses are discovered all the time, security knowledge cannot stay static.
There are several ways of keeping up:
- Security news from reputable industry sources, such as The Register.
- The National Cyber Security Centre (NCSC), the UK’s source of public guidance for individuals, organisations and security professionals, including its guidance for smaller organisations and the 10 Steps to Cyber Security.
- The NVD, for details of publicly disclosed vulnerabilities.
In an IT support role, much of this starts with noticing. A device nobody has listed, a service with remote access switched on, or a user reporting that their email appeared in a breach are all worth raising through the proper route. Recording and reporting what you find is appropriate; testing or probing systems you are not authorised to test is not.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Ask the two questions separately: is it weak, and who can reach it?
Show the answer
Answer: B. Greatest opportunity: change the password, limit access.
An unchanged default password is a weakness, and a page reachable over the internet is exposed: the greatest-opportunity corner. Change the password, and limit who can reach the page.
Apply it
Show the answer
Answer: C. No: check only accounts you are authorised to check.
Check only your own accounts, or organisational ones you are authorised to check, and treat anything found as sensitive. Being able to search is not permission to.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: When Shodan indexed it, the camera’s service was reachable from the internet. The listing alone does not show that the service is still reachable now, that the camera has been compromised or that it has a vulnerability.
Shodan indexes internet-connected devices and services and reveals what is publicly accessible. A listing is therefore evidence that the service was exposed when it was indexed, not evidence of compromise. Indexed responses are stored and made searchable, so a result may no longer match the device today. Exposure, how far a system can be seen or reached, is separate from vulnerability, a weakness. Whether the camera is still reachable, and whether it is weak, for example through an unchanged default password, has to be checked separately.
Revision sources: Session 2: Cyber Fundamentals Part 2 (Classroom session record) · Vulnerabilities and Exposure (Supplementary Study Guide explanation)
Show answer
Answer: A known, unpatched vulnerability: the vendor knows about it and a fix exists, but it has not been applied.
A zero-day is sometimes described broadly as a weakness unknown to the vendor or without an available fix when it becomes exploitable. Here the vendor knows and a fix exists, so it is not a zero-day on either reading. Professional usage makes the distinction explicit: this is a known, unpatched vulnerability, and a zero-day exploit is the means of using a zero-day, not a description of the flaw. Publishing a fix does not protect servers until it is applied.
Revision sources: Session 2: Cyber Fundamentals Part 2 (Classroom session record) · Vulnerabilities and Exposure (Supplementary Study Guide explanation)
Show answer
Answer: The CVE ID names the flaw and CVSS rates its severity; the office’s priority also depends on exposure and the asset.
The NVD is a source of information about publicly disclosed vulnerabilities. The roles are separate: a CVE ID names one disclosed vulnerability, CVSS rates its technical severity and the NVD adds analysis, but none of them measures a particular organisation’s risk. Low exposure and a low-value asset lower this office’s priority without removing the weakness: the flaw is still a vulnerability that needs fixing.
Revision sources: Session 2: Cyber Fundamentals Part 2 (Classroom session record) · Vulnerabilities and Exposure (Supplementary Study Guide explanation)
Show answer
Answer: Remove the port-forwarding rule if remote viewing is not essential.; Provide remote viewing through a more controlled route instead.
Exposure is how far a system can be seen or reached; a vulnerability is a weakness. Removing the forwarding rule, or moving remote viewing to a more controlled route, reduces who can reach the camera. Changing the default password and updating the firmware fix weaknesses, which matters too. Renaming the camera changes neither, although keeping it on the device list helps stop it being forgotten.
Revision sources: Vulnerabilities and Exposure (Supplementary Study Guide explanation)
Study and revision
Practise through the Vulnerabilities topic: questions on exposure and compromise, zero-day terms, the roles of CVE, CVSS and the NVD, and reducing exposure, with flashcards on CVE, CVSS and the NVD and on zero-day terms. Where an item uses this lesson’s supplementary distinctions, its explanation says so. CVSS and the wider risk picture are practised through the Risk Management topic.
Stage: Consolidate
What to remember
- Two separate questions: is it weak (a vulnerability), and who can reach it (exposure)? The danger is in the combination.
- Reachable devices become searchable, so a forgotten internet-facing device can be found by anyone.
- A zero-day is unknown to the vendor; a released but uninstalled fix leaves a known, unpatched vulnerability. Sources differ in between.
- A CVE ID names a flaw, CVSS rates its severity, and only the organisation’s own assessment says how urgent it is there.
- Breached passwords travel: reuse turns one site’s breach into another site’s risk. Search only what you are authorised to.
Key terms
- Vulnerability
A weakness that a threat may exploit.
- Exposure
How far a system, service or piece of information can be seen or reached by others, especially from the internet.
- Zero-day vulnerability
A vulnerability that the vendor does not yet know about, so no fix has been developed when it can be exploited.
- NVD (National Vulnerability Database)
A database maintained by NIST that provides information about publicly disclosed vulnerabilities.
- Shodan
A search engine that indexes internet-connected devices and the services they expose, such as servers, networking equipment and webcams.
Common misunderstandings
Shodan shows that a device is exposed and what it reveals about itself. That is an opportunity for an attacker, not evidence that anyone has used it.
Exposure raises urgency, but an unreachable weakness can become reachable through a stolen account, an insider or a configuration change.
A flaw whose fix has been released but not applied is never a zero-day: it is a known, unpatched vulnerability. A disclosed flaw with no fix yet is where sources differ: the broad usage still says zero-day, while the narrower professional usage reserves the term for a flaw the vendor does not yet know about.
A CVE ID only names the vulnerability. CVSS rates its technical severity, and the organisation’s own risk assessment decides its priority.
CVSS rates technical severity. Exposure, the importance of the asset and existing controls decide the actual risk.
Discovering a weakness gives no permission to exploit it. Report it through an appropriate route.
Further reading
Lesson sources and acknowledgements
Sources and scope
- Taught in Session 2 (see the Session 2 Learning Log): significant breaches and every company is one mistake away from being breached; The Register; the instructor’s Shodan demonstration, including internet-connected cameras, and my own use of Shodan during the session; FOFA, DeHashed, Have I Been Pwned and BreachDirectory; zero-day vulnerabilities and the bank-door analogy; the NVD; the NCSC and its 10 Steps; and the two risk models.
- Supplementary explanation: how device search engines index services, the simplified vulnerability lifecycle, the professional distinction between zero-day vulnerabilities, known unpatched vulnerabilities and zero-day exploits, the account of where the broad and narrower usages differ, CVE and CVSS details and the guidance on responsible use of breach services. These are my explanations, not the instructor’s words. The classroom definition of a zero-day is quoted as taught.
- Fictional examples: the office camera and the vulnerability entry are invented for teaching.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the broken-lock opening questions, every question asked in the lesson with its feedback and hints, the finance-server, shopping-site, heating-controller and breach-search examples and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- Shodan in Session 2: the instructor demonstrated Shodan, and I also used it during the session. No practical work is claimed beyond that classroom use: I did not scan, access or test any exposed system, or carry out a vulnerability assessment or penetration test.
Something an organisation values, such as information, a service, equipment or a business capability.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
A system of unique identifiers for publicly disclosed vulnerabilities, written as CVE-year-number, so everyone can refer to the same flaw.
A standard for rating the technical severity of vulnerabilities. The same base score can carry different business risk depending on context.
How far a system, service or piece of information can be seen or reached by others, especially from the internet.
The software built into a device to make its hardware work, such as the program inside a camera, printer, router or switch.
How serious the consequences of an event would be for the organisation and the people affected.
Everyday physical devices, such as cameras, sensors and smart appliances, that connect to a network or the internet.
How probable it is that a defined event will happen over a stated period.
A database maintained by NIST that provides information about publicly disclosed vulnerabilities.
A deceptive message designed to trick the recipient into an action, such as revealing sign-in details or opening a malicious link.
A document that sets organisational rules and expectations, defining what is and is not permitted.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
A device that forwards traffic between networks, for example between a private local network and the internet.
A search engine that indexes internet-connected devices and the services they expose, such as servers, networking equipment and webcams.
A potential cause of harm, such as an attacker seeking unauthorised access.
A person or group that may cause harm to systems or information. Threat actors are often assessed by their motivation, capability and opportunity.
A weakness that a threat may exploit.
A vulnerability that the vendor does not yet know about, so no fix has been developed when it can be exploited.
Code or a technique that takes advantage of a zero-day vulnerability, while the vendor does not yet know about the flaw.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.