Vulnerability
A vulnerability is a weakness in a system, design, configuration, or security procedure that can be exploited or triggered to cause harm.
A vulnerability is the weakness, rather than the person who attacks it or the damage that follows. It can be a software flaw, but the broader security meaning also includes weaknesses in configuration and procedures.
For example, a recovery procedure that accepts an unverified caller’s replacement contact details may create an exploitable trust gap. That is a different kind of finding from a memory-handling flaw in an application. Both need a clear description of what can go wrong and under which conditions.
Describe the condition, not just the label
A useful finding names the affected component or process, the circumstances that expose the weakness, and the possible consequence. A scanner result is a lead to evaluate; it does not by itself establish that an attacker successfully used the weakness.
Risk adds context: how the weakness could be reached, which safeguards apply, and what the affected service or data means to the organization. The same underlying flaw can matter differently in two environments.
Use vulnerability assessment for the work of finding and evaluating weaknesses, and exploit for the method that uses one. Keeping those terms separate makes a finding easier to act on: what is wrong, how it could be used, and what needs to change.