Definition
Vulnerability
In one sentence
A vulnerability is a weakness in software, hardware, configuration or process that an attacker could exploit to gain unauthorized access, disrupt systems or steal data.
Vulnerability Explained
Vulnerabilities include coding flaws, missing patches, default passwords, overly broad permissions, exposed services and misconfigured cloud storage. Publicly known software vulnerabilities receive a CVE identifier and are usually scored for severity using the Common Vulnerability Scoring System (CVSS).
Severity scores alone can mislead. A critical-rated flaw on an isolated internal system may be less urgent than a medium-rated one on an internet-facing VPN. Better prioritization considers whether the vulnerability is being actively exploited, which the U.S. CISA tracks in its Known Exploited Vulnerabilities catalogue, how exposed the system is, and how important it is to the business.
For a Canadian SMB, a practical approach is to scan regularly, fix actively exploited and internet-facing vulnerabilities first, set target timelines for the rest, and track progress. Configuration weaknesses, such as missing MFA or excessive admin rights, deserve the same attention as missing patches, since attackers exploit them just as readily.
General information for Canadian organizations, not legal advice.