What is a Vulnerability?

Ingrid

A vulnerability is a flaw or weakness in a system’s design, implementation, or operation and management that could be exploited to violate the system’s security policy. Vulnerabilities that share common frameworks and events may be part of a vulnerability group (a.k.a. threat group).

This article defines vulnerability terms and the details that Bitsight reports for each vulnerability.

What is a vulnerability?

A vulnerability is a flaw or weakness in a system’s design, implementation, or operation and management. Someone could exploit it to violate the system’s security policy. Each vulnerability has a CVE ID and, for prominent vulnerabilities, a vulnerability name.

What details does a vulnerability include?

Each vulnerability includes the details in the table below.

Detail	What it shows
Classification	Whether the host is vulnerable. [Add the possible values and what each one means.]
CVE ID	The Common Vulnerabilities and Exposures identifier for the vulnerability. Search for this ID on the web or in the National Vulnerability Database (NVD).
Dynamic Vulnerability Exploit (DVE)	The predicted likelihood that the vulnerability will be exploited in the next 90 days. The prediction models exploitation activity based on threat intelligence.
Evidence available	Whether evidence of exposure to the vulnerability is available. [Add how the evidence appears and where to find it.]
Evidence Certainty	How certain Bitsight is about a company’s detection status for the vulnerability.
Exploit Prediction Scoring System (EPSS)	The estimated likelihood that the vulnerability will be exploited. A higher percentage means a higher likelihood of exploitation.
Exposure Detection	The company’s protection status against the threat. [Add the possible values.]
Vulnerability Severity	The criticality of the vulnerability, summarized by Bitsight severity, which follows the Common Vulnerability Scoring System (CVSS).

How is vulnerability severity determined?

Bitsight determines vulnerability severity using the Common Vulnerability Scoring System (CVSS). CVSS scores a vulnerability based on its properties. Bitsight uses CVSS v3.0 for scoring in the Bitsight platform.

Each CVSS score maps to one Bitsight severity level:

Bitsight severity	Slug name	CVSS score
Minor	`minor`	0.0 to 3.9
Moderate	`moderate`	4.0 to 6.9
Material	`material`	7.0 to 8.9
Severe	`severe`	9.0 to 10.0

A vulnerability with a higher severity level carries more weight than a less critical vulnerability observed in the same time period.

Publish Date or Recent Edits

March 19, 2026: Security Posture Management rebrand.
July 8, 2025: Evidence available.
April 3, 2025: Dynamic Vulnerability Exploit (DVE); Linked to the Emerging Security Events card.
October 18, 2024: Exploit Prediction Scoring System (EPSS).