NOCTI Cybersecurity Standard Certification Practice Exam

A weakness in a system that could be exploited by an attacker is called a vulnerability. A vulnerability is a flaw in design, implementation, or operation that could be taken advantage of by a threat actor to compromise security, break confidentiality, integrity, or availability, or bypass safeguards. It’s the point of weakness that could be exploited if a suitable threat occurs.

Think of a vulnerability as the flaw itself—like unpatched software with a known security flaw, default credentials, or a misconfigured firewall. A threat, by contrast, is a potential source of harm: the attacker, malware, or event that might exploit that flaw. Risk combines both likelihood and impact—how likely the threat is to exploit the vulnerability and what the resulting impact would be. A control is a safeguard or countermeasure put in place to reduce or mitigate that risk.

So the term that best fits “a weakness in a system that could be exploited by an attacker” is vulnerability.