How Was the Vulnerability Found?

About this interactive

The Vulnerability Management lesson runs identify, analyze, report, remediate and verify. This activity practises the first step: where vulnerabilities come from. The lesson names five sources. The vendor reports it. Software makers find flaws in their own products and announce them, usually with a patch: an advisory, a security notice, an update banner. A vulnerability scan finds it. Scanning software checks your systems against known weaknesses and reports what it found, often with a risk level. A feed or forum publishes it. Third parties track vulnerabilities: the CVE list of common vulnerabilities and exposures, threat intelligence feeds, mailing lists and admin forums. The difference from the first source is who is speaking: a feed is someone other than the maker. A penetration test proves it. Testers you hire, or an internal team, actively try to break in and report what worked. A disclosure program brings it in. You invite outsiders to look for flaws and report them, often for a reward such as a gift card or a bug bounty. The difference from a penetration test is that nobody was hired: the researcher found it on their own and reported it through your program. However a vulnerability was found, the lesson ends the process by checking the fix the same way.

What you'll learn

Identify how a vulnerability was found: a vendor's own report, a vulnerability scan, a feed or forum, a penetration test, or a disclosure program
Distinguish a hired penetration test from an outside researcher reporting through a disclosure program, and a vendor's own notice from a third-party feed

Aligned to

CompTIA Security+

4.3 Explain various activities associated with vulnerability management.

Key terms

Vulnerability Management: The operational practice of identifying, evaluating, and remediating weaknesses in technology systems, distinct from the broader business-risk scope of risk management.
Penetration Testing: An authorized simulated attack on a system to identify and evaluate security vulnerabilities.
Responsible Disclosure Program: A formal program in which organizations invite external researchers or hackers to identify and report vulnerabilities, typically rewarding them with a bug bounty.
Common Vulnerabilities and Exposures: Common Vulnerabilities and Exposures is a publicly maintained dictionary that assigns unique identifiers to known software and hardware vulnerabilities, providing a common reference point for vulnerability tracking, disclosure, and remediation.
Threat Intelligence: Information about existing or emerging threats that helps organizations make informed security decisions.
Vulnerability: A weakness in a system, application, or process that can be exploited by a threat actor.

Topics

Vulnerability Management Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →