{"id":20106,"date":"2026-09-28T23:02:31","date_gmt":"2026-09-29T03:02:31","guid":{"rendered":"https:\/\/www.netwitness.com\/?post_type=glossary&#038;p=20106"},"modified":"2026-10-13T05:36:44","modified_gmt":"2026-10-13T09:36:44","slug":"network-vulnerability","status":"publish","type":"glossary","link":"https:\/\/www.netwitness.com\/cyber-glossary\/network-vulnerability\/","title":{"rendered":"Network Vulnerability"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"20106\" class=\"elementor elementor-20106\" data-elementor-post-type=\"glossary\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d7f09d2 e-flex e-con-boxed e-con e-parent\" data-id=\"d7f09d2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7565758 elementor-widget elementor-widget-heading\" data-id=\"7565758\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What is Network Vulnerability?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-da689aa elementor-widget elementor-widget-text-editor\" data-id=\"da689aa\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Network vulnerability is a weakness in a network&#8217;s hardware, software, configuration, architecture, protocols, or security controls that could be exploited by an attacker to gain unauthorized access, disrupt operations, move between systems, or compromise data.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">NIST broadly defines vulnerability as a weakness in an information system, security procedure, internal control, or implementation that could be exploited or triggered by a threat source.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Network vulnerability is the weakness itself, not the attack that takes advantage of it.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">For example, an internet-facing VPN appliance running vulnerable firmware represents a network security vulnerability. An attacker exploiting that weakness to gain initial access is the attack. Ransomware deployed after that is a potential consequence.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Network vulnerabilities can exist almost anywhere connectivity exists: firewalls, routers, switches, VPN gateways, servers, wireless networks, cloud infrastructure, endpoints, IoT devices, <a href=\"https:\/\/www.netwitness.com\/modules\/operational-technology-security\/\" target=\"_blank\" rel=\"noopener\">operational technology (OT)<\/a>, and the trust relationships connecting them.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">This distinction matters because effective network security is not simply about finding vulnerabilities. Security teams need to understand which weaknesses are exposed, which are exploitable, what an attacker could reach through them, and whether suspicious activity is already occurring around those assets.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-c0a0ede e-con-full e-flex e-con e-child\" data-id=\"c0a0ede\" data-element_type=\"container\" data-e-type=\"container\" id=\"synonyms\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a3b8a4f elementor-widget__width-initial elementor-widget elementor-widget-heading\" data-id=\"a3b8a4f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Synonyms<\/h2>\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-0fdb30d e-con-full e-flex e-con e-child\" data-id=\"0fdb30d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1a15d76 elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"1a15d76\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Network Exposure<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Network Security Gap<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Network Attack Surface<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Network Threat Exposure<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Network Vulnerability Risk<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Cybersecurity Vulnerability<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Infrastructure Vulnerability<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Network Configuration Weakness<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Network Security Vulnerability<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Network Security Misconfiguration<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9397ba4 elementor-widget elementor-widget-heading\" data-id=\"9397ba4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Does Network Vulnerability Create Security Risk?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ef941d5 elementor-widget elementor-widget-text-editor\" data-id=\"ef941d5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">A network vulnerability does not exist in isolation. Its actual security significance depends heavily on where it exists and what an attacker can do with it.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A useful way to look at the progression is:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><b><span data-contrast=\"auto\">Vulnerability \u2192 Exposure \u2192 Exploitation \u2192 Access \u2192 Movement \u2192 Impact<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Consider an organization running an unpatched VPN gateway:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ol><li><b><span data-contrast=\"auto\">Vulnerability:<\/span><\/b><span data-contrast=\"auto\"> The VPN software contains a known security flaw.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Exposure:<\/span><\/b><span data-contrast=\"auto\"> The device is accessible from the internet.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Exploitation:<\/span><\/b><span data-contrast=\"auto\"> An attacker has access to working exploit code.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Initial access:<\/span><\/b><span data-contrast=\"auto\"> The vulnerability allows the attacker to enter the network.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Movement:<\/span><\/b><span data-contrast=\"auto\"> Poor segmentation allows access to internal systems.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Impact:<\/span><\/b><span data-contrast=\"auto\"> The attacker reaches sensitive systems, steals data, or deploys ransomware.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ol><p><span data-contrast=\"auto\">The presence of vulnerability therefore tells only part of the story. A critical vulnerability on an isolated laboratory system may present less immediate risk than a lower-scored vulnerability on an internet-facing device that provides a direct path to sensitive infrastructure.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">That is why modern vulnerability management needs to look beyond vulnerability counts and severity scores.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-26738ec elementor-widget elementor-widget-heading\" data-id=\"26738ec\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Network Vulnerability vs. Threat vs. Exploit vs. Exposure vs. Risk<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-67c7bf4 elementor-widget elementor-widget-text-editor\" data-id=\"67c7bf4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span class=\"TextRun SCXW230954 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW230954 BCX0\">These terms are often used interchangeably, but they describe <\/span><span class=\"NormalTextRun SCXW230954 BCX0\">different parts<\/span><span class=\"NormalTextRun SCXW230954 BCX0\"> of the security problem.<\/span><\/span><\/p><table data-tablestyle=\"MsoTable15Grid6ColorfulAccent1\" data-tablelook=\"1696\" aria-rowcount=\"7\"><tbody><tr aria-rowindex=\"1\"><td data-celllook=\"256\"><strong><span class=\"TextRun SCXW50913808 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW50913808 BCX0\">Term<\/span><\/span><\/strong><\/td><td data-celllook=\"256\"><strong><span class=\"TextRun SCXW12538142 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW12538142 BCX0\">Meaning<\/span><\/span><\/strong><\/td><td data-celllook=\"256\"><strong><span class=\"TextRun SCXW6774680 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW6774680 BCX0\">Examples<\/span><\/span><\/strong><\/td><\/tr><tr aria-rowindex=\"2\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW232400374 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW232400374 BCX0\"><span class=\"TextRun SCXW196065940 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW196065940 BCX0\">Vulnerability<\/span><\/span><\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW205623439 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW205623439 BCX0\">A weakness that could be exploited<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW210367133 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW210367133 BCX0\">An unpatched flaw in a VPN gateway<\/span><\/span><span class=\"EOP SCXW210367133 BCX0\" data-ccp-props=\"{}\">\u00a0<\/span><\/td><\/tr><tr aria-rowindex=\"3\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW40832703 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW40832703 BCX0\">Exposure<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW96870438 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW96870438 BCX0\">A condition that makes the weakness reachable or accessible<\/span><\/span><span class=\"EOP SCXW96870438 BCX0\" data-ccp-props=\"{}\">\u00a0<\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW185966792 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW185966792 BCX0\">The vulnerable VPN is exposed to the internet<\/span><\/span><span class=\"EOP SCXW185966792 BCX0\" data-ccp-props=\"{}\">\u00a0<\/span><\/td><\/tr><tr aria-rowindex=\"4\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW138796699 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW138796699 BCX0\">Threat<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW137345848 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW137345848 BCX0\">An actor, event, or capability that could cause harm<\/span><\/span><span class=\"EOP SCXW137345848 BCX0\" data-ccp-props=\"{}\">\u00a0<\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW73624399 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW73624399 BCX0\">A ransomware group targeting exposed VPN infrastructure<\/span><\/span><span class=\"EOP SCXW73624399 BCX0\" data-ccp-props=\"{}\">\u00a0<\/span><\/td><\/tr><tr aria-rowindex=\"5\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW38627336 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW38627336 BCX0\">Exploit<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW267159564 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW267159564 BCX0\">Code or a technique used to take advantage of a vulnerability<\/span><\/span><span class=\"EOP SCXW267159564 BCX0\" data-ccp-props=\"{}\">\u00a0<\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW190338834 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW190338834 BCX0\">Exploit code designed for the VPN vulnerability<\/span><\/span><span class=\"EOP SCXW190338834 BCX0\" data-ccp-props=\"{}\">\u00a0<\/span><\/td><\/tr><tr aria-rowindex=\"7\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW132209947 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW132209947 BCX0\">Risk<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW116420915 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW116420915 BCX0\">The potential for loss based on factors such as likelihood, <\/span><span class=\"NormalTextRun SCXW116420915 BCX0\">exposure<\/span><span class=\"NormalTextRun SCXW116420915 BCX0\"> and impact<\/span><\/span><span class=\"EOP SCXW116420915 BCX0\" data-ccp-props=\"{}\">\u00a0<\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW99314777 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW99314777 BCX0\">Compromise of the VPN could provide access to critical systems<\/span><\/span><span class=\"EOP SCXW99314777 BCX0\" data-ccp-props=\"{}\">\u00a0<\/span><\/td><\/tr><\/tbody><\/table><p><span data-contrast=\"auto\">This also explains why <a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/malware\/\" target=\"_blank\" rel=\"noopener\">malware<\/a>, <a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/ransomware\/\" target=\"_blank\" rel=\"noopener\">ransomware<\/a>, <a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/phishing\/\" target=\"_blank\" rel=\"noopener\">phishing<\/a> attacks, <a href=\"https:\/\/www.netwitness.com\/blog\/how-threat-detection-and-response-fight-gain-social-engineering-attacks\/\" target=\"_blank\" rel=\"noopener\">social engineering<\/a>, and malicious insiders are not network vulnerabilities. They are threats, attack methods, or threat sources that may take advantage of vulnerabilities.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">For example, phishing may give an attacker valid credentials. Weak authentication controls or unrestricted network access can then make those credentials far more useful.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6de16b4 elementor-widget elementor-widget-heading\" data-id=\"6de16b4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What Are the Most Common Network Vulnerability Types?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ed15f5d elementor-widget elementor-widget-text-editor\" data-id=\"ed15f5d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">There is no single source of network weakness. Modern enterprise networks combine on-premises infrastructure, endpoints, cloud services, remote access, SaaS applications, third-party connections, <a href=\"https:\/\/www.netwitness.com\/blog\/iot-network-security-with-unified-visibility\/\" target=\"_blank\" rel=\"noopener\">IoT<\/a>, and sometimes OT environments.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">That creates several major network vulnerability types.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>1. Unpatched Software and Firmware:<\/strong><\/h3><p><span data-contrast=\"auto\">Routers, firewalls, switches, VPN appliances, operating systems, and other network-connected technologies regularly receive security updates. Delaying those updates can leave known vulnerabilities accessible long after a fix becomes available.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Publicly disclosed cybersecurity vulnerabilities are commonly tracked through Common Vulnerabilities and Exposures (CVE) identifiers. The CVE Program provides standardized identifiers and records so that vendors, researchers, and security teams can consistently refer to the same vulnerability.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Not every network vulnerability has a CVE, however. Weak configurations, architectural problems, and excessive permissions can create serious risk without corresponding to a specific software flaw.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>2. Network Misconfigurations:<\/strong><\/h3><p><span data-contrast=\"auto\">A network misconfiguration can expose services or create access paths that were never intended.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Examples include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">overly permissive firewall rules;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">unnecessary inbound access;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">unrestricted outbound connections;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">incorrectly configured access control lists;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">exposed administrative interfaces;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">insecure cloud security groups;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">routing errors;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">default configurations; and<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">excessive trust between network zones.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Configuration drift can make this especially challenging. A network may have been securely configured when deployed but gradually become less secure as administrators make changes, new systems are introduced, and temporary exceptions become permanent.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>3. Exposed Ports and Services:<\/strong><\/h3><p><span data-contrast=\"auto\">Every externally or internally accessible service expands the potential attack surface.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Remote administration interfaces, RDP, SSH, VPN services, databases, and management consoles can create opportunities for attackers when they are unnecessarily exposed, improperly configured, or protected with weak authentication.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">An open port is not automatically a vulnerability. The risk comes from what is listening on that port, who can reach it, how it is configured, and whether the service contains exploitable weaknesses.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>4. Weak Authentication and Access Controls:<\/strong><\/h3><p><span data-contrast=\"auto\">Networks become easier to compromise when access depends on default passwords, weak credentials, shared accounts, or authentication mechanisms that lack appropriate safeguards.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Common issues include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">missing multifactor authentication;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">default credentials;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">credential reuse;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">excessive privileges;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">stale accounts;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">weak service-account controls; and<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">broad administrative access.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">These weaknesses are especially important because many modern <\/span><a href=\"https:\/\/www.netwitness.com\/blog\/incident-response-lessons-from-cyberattack\/\" target=\"_blank\" rel=\"noopener\"><b><span data-contrast=\"auto\">cyberattacks<\/span><\/b><\/a><span data-contrast=\"auto\"> do not need to exploit software if attackers can simply authenticate using valid credentials.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>5. Poor Network Segmentation:<\/strong><\/h3><p><span data-contrast=\"auto\">Segmentation limits what systems can communicate with each other and can reduce the impact of an initial compromise.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">In a flat network, compromising one device may provide an attacker with access to many more systems. Weak internal controls can therefore turn a relatively contained breach into an opportunity for reconnaissance and lateral movement.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A network vulnerability assessment should consequently examine not only individual devices but also the paths between them.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>6. Insecure or Legacy Network Protocols:<\/strong><\/h3><p><span data-contrast=\"auto\">Older protocols may transmit information without encryption or provide weak authentication and security controls.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Examples include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Telnet;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">FTP;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">HTTP where HTTPS should be used;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">outdated versions of SMB;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">weak SNMP configurations; and<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">obsolete cryptographic protocols.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Legacy systems can create particular network vulnerability challenges when operational requirements make replacement or patching difficult.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>7. Wireless Network Vulnerabilities:<\/strong><\/h3><p><span data-contrast=\"auto\">Wireless connectivity introduces additional considerations because network traffic travels over radio rather than remaining confined to physical cabling.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Weak encryption, outdated wireless security standards, insecure guest networks, poor authentication, rogue access points, and improperly configured wireless infrastructure can expose users and systems to interception or unauthorized access.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>8. Cloud and Hybrid Network Vulnerabilities:<\/strong><\/h3><p><span data-contrast=\"auto\">Moving applications to the cloud does not eliminate network vulnerabilities. It changes where many of them appear.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Potential issues include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">overly permissive security groups;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">exposed management interfaces;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">incorrect network access controls;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">publicly accessible services;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">improperly configured virtual networks;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">weak connections between cloud and on-premises infrastructure; and<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">excessive trust between workloads or environments.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Application security also intersects with<a href=\"https:\/\/www.netwitness.com\/blog\/network-security-policy-step-by-step-guide\/\" target=\"_blank\" rel=\"noopener\"> network security<\/a> here. A vulnerable application exposed through cloud infrastructure may become an entry point into connected resources.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>9. IoT, OT and Unmanaged Device Vulnerabilities:<\/strong><\/h3><p><span data-contrast=\"auto\">Connected devices are easy to overlook during traditional vulnerability assessment.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Some may use default credentials, unsupported firmware or legacy protocols. Others may be difficult to patch because they perform critical operational functions.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Unknown and unmanaged assets create an additional problem: security teams cannot assess or protect devices they do not know exist.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ce3b4d3 elementor-widget elementor-widget-heading\" data-id=\"ce3b4d3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What Causes Network Vulnerabilities?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-370c351 elementor-widget elementor-widget-text-editor\" data-id=\"370c351\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Network vulnerability often develop from a combination of technical weaknesses, operational decisions, and changes that accumulate over time.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Common causes include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Delayed security patches and firmware updates<\/span><\/li><li><span data-contrast=\"auto\">Insecure default configurations<\/span><\/li><li><span data-contrast=\"auto\">Configuration drift<\/span><\/li><li><span data-contrast=\"auto\">Weak authentication<\/span><\/li><li><span data-contrast=\"auto\">Excessive user or system privileges<\/span><\/li><li><span data-contrast=\"auto\">Unsupported hardware and software<\/span><\/li><li><span data-contrast=\"auto\">Legacy protocols<\/span><\/li><li><span data-contrast=\"auto\">Poor network segmentation<\/span><\/li><li><span data-contrast=\"auto\">Unnecessary services<\/span><\/li><li><span data-contrast=\"auto\">Rapidly changing cloud environments<\/span><\/li><li><span data-contrast=\"auto\">Shadow IT and unmanaged assets<\/span><\/li><li><span data-contrast=\"auto\">Insecure third-party connectivity; and<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Gaps between security policies and their actual implementation.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Business network vulnerabilities also change continuously. A configuration considered safe yesterday may become exposed after a firewall change, new cloud connection or remote-access deployment.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">That is why <a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/network-security-vulnerability\/\" target=\"_blank\" rel=\"noopener\">vulnerability monitoring<\/a> cannot be treated purely as a periodic compliance exercise.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2c608d2 elementor-widget elementor-widget-heading\" data-id=\"2c608d2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Do Attackers Exploit Network Vulnerabilities?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-679c848 elementor-widget elementor-widget-text-editor\" data-id=\"679c848\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Network vulnerability exploitation rarely represents the entire attack. It is usually one stage within a broader attack path.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">An attacker might:<\/span><\/p><ol><li><span data-contrast=\"auto\">Discover an internet-facing asset.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Enumerate its ports, services, and software versions.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Identify a known vulnerability or configuration weakness.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Exploit the vulnerability or abuse compromised credentials.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Establish access to the environment.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Perform network reconnaissance.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Identify additional systems and accounts.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Move laterally.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Escalate privileges.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Access sensitive systems, exfiltrate information or disrupt operations.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ol><p><span data-contrast=\"auto\">Network vulnerability can therefore have significance far beyond the device on which it exists.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A compromised edge appliance, for example, becomes more consequential when that device provides a route into a poorly segmented network.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/blog\/network-threat-detection-and-response\/\" target=\"_blank\" rel=\"noopener\">Network threat defense<\/a> needs to consider the attack path around vulnerability, not simply whether a vulnerable version of software has been discovered.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c20598a elementor-widget elementor-widget-heading\" data-id=\"c20598a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Are Network Vulnerabilities Identified?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3b42699 elementor-widget elementor-widget-text-editor\" data-id=\"3b42699\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Organizations typically use several complementary techniques to identify network vulnerability. No single method provides a complete picture.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>1. Asset Discovery and Inventory:<\/strong><\/h3><p><span data-contrast=\"auto\">The first challenge is knowing what needs to be assessed.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Asset discovery can identify network-connected devices, operating systems, applications, cloud resources, network appliances and other infrastructure.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">An incomplete inventory creates a blind spot before vulnerability assessment even begins.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>2. Vulnerability Scanning:<\/strong><\/h3><p><span data-contrast=\"auto\">Vulnerability scanning uses automated tools to examine systems for known weaknesses such as:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">missing patches<\/span><\/li><li><span data-contrast=\"auto\">known CVEs<\/span><\/li><li><span data-contrast=\"auto\">outdated software<\/span><\/li><li><span data-contrast=\"auto\">insecure services<\/span><\/li><li><span data-contrast=\"auto\">exposed ports; and<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">some configuration weaknesses.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Credentialed scanning typically provides greater visibility into the state of a system because the scanner can inspect it using authorized access. External or unauthenticated scanning is useful for understanding what a system exposes without those credentials.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>3. Configuration Assessment:<\/strong><\/h3><p><span data-contrast=\"auto\">Not every security weakness maps to a software vulnerability.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Configuration assessment examines whether systems, firewalls, routers, cloud controls, and other infrastructure have been configured securely.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">This is particularly useful for identifying a network configuration weakness or network security misconfiguration that traditional CVE-focused scanning could miss.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>4. Penetration Testing:<\/strong><\/h3><p><span data-contrast=\"auto\">Penetration testing goes beyond discovering a weakness and attempts, within an authorized scope, to determine whether vulnerabilities can be exploited and what an attacker could achieve.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">NIST&#8217;s guidance distinguishes security testing techniques and notes that assessments can be used to find vulnerabilities in systems or networks and evaluate security controls.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Vulnerability scanning therefore answers a different question from penetration testing.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>5. Threat Intelligence Integration:<\/strong><\/h3><p><span data-contrast=\"auto\">Threat intelligence integration helps vulnerability teams add external context.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Security teams can ask:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Is exploit code publicly available?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Is this vulnerability being targeted?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Has it been observed in real attacks?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Which threat actors or malware families are associated with it?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Are attacks increasing?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">This matters because vulnerability severity and attacker interest are not the same thing.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>6. Network Security Monitoring and NDR:<\/strong><\/h3><p><span data-contrast=\"auto\">Network security monitoring provides another type of context.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Vulnerability scanners primarily tell teams where weaknesses may exist. Network traffic monitoring, network traffic analysis, and <a href=\"https:\/\/www.netwitness.com\/modules\/network-detection-and-response-ndr\/\" target=\"_blank\" rel=\"noopener\">network detection and response (NDR)<\/a> can help identify suspicious behavior occurring around those systems.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Depending on available telemetry and detection capabilities, these may include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">unusual connections to a vulnerable server;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">reconnaissance or scanning activity;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">unexpected protocol usage;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">lateral movement;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">command-and-control communications;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">unusual data transfers; or<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">changes in communication patterns.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">NDR is not a replacement for network vulnerability scanning. <\/span><span data-contrast=\"auto\">Combining these perspectives gives security teams more useful context for threat detection and remediation.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fd2427e elementor-widget elementor-widget-heading\" data-id=\"fd2427e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Network Vulnerability Scanning vs. Vulnerability Assessment vs. Penetration Testing<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d0b9110 elementor-widget elementor-widget-text-editor\" data-id=\"d0b9110\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span class=\"TextRun SCXW205296942 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW205296942 BCX0\">These activities are related but should not be treated as synonyms.<\/span><\/span><\/p><table data-tablestyle=\"MsoTable15Grid6ColorfulAccent1\" data-tablelook=\"1696\" aria-rowcount=\"7\"><tbody><tr aria-rowindex=\"1\"><td data-celllook=\"256\"><strong><span class=\"TextRun SCXW50913808 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW50913808 BCX0\">Approach<\/span><\/span><\/strong><\/td><td data-celllook=\"256\"><strong><span class=\"TextRun SCXW266424270 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW266424270 BCX0\">Primary question<\/span><\/span><\/strong><\/td><td data-celllook=\"256\"><strong><span class=\"TextRun SCXW70802363 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW70802363 BCX0\">Typical purpose<\/span><\/span><\/strong><\/td><\/tr><tr aria-rowindex=\"2\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW100763933 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW100763933 BCX0\">Vulnerability scanning<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW194135726 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW194135726 BCX0\">What known weaknesses can be detected?<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW122613952 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW122613952 BCX0\">Automated identification of vulnerabilities and misconfigurations<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"3\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW183711277 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW183711277 BCX0\">Vulnerability assessment<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW18200284 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW18200284 BCX0\">Which vulnerabilities exist, how significant are they, and what should be addressed?<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW120424682 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW120424682 BCX0\">Analysis, <\/span><span class=\"NormalTextRun SCXW120424682 BCX0\">validation<\/span><span class=\"NormalTextRun SCXW120424682 BCX0\"> and prioritization<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"4\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW253682012 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW253682012 BCX0\">Penetration testing<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW33067982 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW33067982 BCX0\">Can weaknesses be exploited, and what access could they provide?<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW189400808 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW189400808 BCX0\">Controlled validation of attack paths<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"7\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW232557176 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW232557176 BCX0\">Network monitoring\/NDR<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW11218259 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW11218259 BCX0\">Is suspicious behavior occurring in network traffic?<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW12641523 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW12641523 BCX0\">Ongoing behavioral detection and investigation<\/span><\/span><\/td><\/tr><\/tbody><\/table><p><span class=\"TextRun SCXW161316836 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW161316836 BCX0\">A <\/span><span class=\"NormalTextRun SCXW161316836 BCX0\">network security vulnerability assessment<\/span><span class=\"NormalTextRun SCXW161316836 BCX0\"> will often combine information from multiple sources rather than relying on a scanner alone.<\/span><\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3feb237 elementor-widget elementor-widget-heading\" data-id=\"3feb237\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Should Network Vulnerabilities Be Prioritized?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a005d08 elementor-widget elementor-widget-text-editor\" data-id=\"a005d08\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">One of the biggest problems in vulnerability management is treating every high-severity finding as equally urgent. They are not. Prioritization should ask not only \u201cHow severe is this vulnerability?\u201d but also \u201cHow much risk does this particular vulnerability create in this particular environment?\u201d<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Several factors help answer that question.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>1. Technical Severity:<\/strong><\/h3><p><span data-contrast=\"auto\">The Common Vulnerability Scoring System (CVSS) provides a standardized way to communicate characteristics and severity of software vulnerabilities. The current CVSS 4.0 framework includes Base, Threat, Environmental, and Supplemental metric groups.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">CVSS is useful, but severity is only one input into prioritization.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>2. Evidence of Active Exploitation:<\/strong><\/h3><p><span data-contrast=\"auto\">CISA maintains the Known Exploited Vulnerabilities (KEV) Catalog for vulnerabilities that have evidence of exploitation in the wild and recommends using the catalog as an input to vulnerability-management prioritization.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A vulnerability already being exploited deserves different consideration from one that is theoretically exploitable but shows no known activity.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>3. Probability of Exploitation:<\/strong><\/h3><p><span data-contrast=\"auto\">The Exploit Prediction Scoring System (EPSS) estimates the probability that a published CVE will be exploited in the wild within the next 30 days.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">EPSS is deliberately not a complete risk score. FIRST notes that it does not know whether a vulnerability affects a particular organization, what compensating controls are in place, or what the business impact would be. That context has to come from the organization.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>4. Network Exposure:<\/strong><\/h3><p><span data-contrast=\"auto\">Ask:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Is the asset internet-facing?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Can untrusted users reach it?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Is access restricted?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Is it behind segmentation or additional controls?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Which network zones can communicate with it?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">A vulnerability that cannot be reached presents a different immediate risk from one directly exposed to attackers.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>5. Asset Criticality:<\/strong><\/h3><p><span data-contrast=\"auto\">What does the affected system do?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A network vulnerability affecting a development test machine may have different consequences from the same vulnerability affecting an identity server, production database, payment system, or critical network appliance.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>6. Attack-Path Reachability:<\/strong><\/h3><p><span data-contrast=\"auto\">The next question is: If this asset is compromised, where can an attacker go?<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><em>Network architecture matters here.\u00a0<\/em><\/p><p><span data-contrast=\"auto\">A system that provides routes to privileged accounts, sensitive servers, management networks, or critical workloads may deserve greater attention than its vulnerability score alone suggests.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>7. Compensating Controls:<\/strong><\/h3><p><span data-contrast=\"auto\">Controls such as segmentation, IPS, restrictive access policies, application controls and strong authentication may reduce the opportunity for successful exploitation while remediation is underway.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">They should not be assumed to eliminate the underlying vulnerability, but they can affect immediate exposure.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>8. Observed Network Activity:<\/strong><\/h3><p><span data-contrast=\"auto\">Finally, vulnerability data can be combined with security telemetry.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A vulnerable server that is already receiving unusual connection attempts or suddenly communicating with unfamiliar internal systems deserves investigation beyond routine patch scheduling.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A practical prioritization model therefore looks more like:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Technical severity + exploitation evidence + exploitation likelihood + network exposure + asset criticality + attack-path reachability + compensating controls + observed behavior <\/span><span data-contrast=\"auto\">rather than simply: Highest CVSS score first.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2016558 elementor-widget elementor-widget-heading\" data-id=\"2016558\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Can Organizations Reduce Network Vulnerability?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8ddcef6 elementor-widget elementor-widget-text-editor\" data-id=\"8ddcef6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Reducing network security risks is an ongoing process rather than a one-time remediation project.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A useful lifecycle is:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><b><span data-contrast=\"auto\">Discover \u2192 Assess \u2192 Prioritize \u2192 Remediate \u2192 Verify \u2192 Monitor<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p aria-level=\"3\"><strong># Discover: <\/strong><span data-contrast=\"auto\">Maintain visibility into devices, systems, services, and cloud resources connected to the environment.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p aria-level=\"3\"><strong># Assess: <\/strong><span data-contrast=\"auto\">Use network vulnerability assessment tools, configuration analysis, and security testing to identify weaknesses.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p aria-level=\"3\"><strong># Prioritize: <\/strong><span data-contrast=\"auto\">Combine technical severity with exploit intelligence, asset importance, network exposure, and environmental context.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p aria-level=\"3\"><strong># Remediate or Mitigate: <\/strong><span data-contrast=\"auto\">Depending on the vulnerability, this may involve:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">applying patches;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">upgrading firmware;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">changing configurations;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">disabling unnecessary services;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">restricting network access;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">rotating credentials;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">adding MFA;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">improving segmentation; or<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">retiring unsupported infrastructure.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Where immediate remediation is impossible, compensating controls can help reduce exposure until the weakness can be fixed.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p aria-level=\"3\"><strong># Verify: <\/strong><span data-contrast=\"auto\">Do not assume a vulnerability has disappeared because a remediation ticket was closed.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Rescan or retest affected systems to confirm that the weakness has actually been removed.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p aria-level=\"3\"><strong># Monitor: <\/strong><span data-contrast=\"auto\">Continue monitoring the environment for configuration changes, newly disclosed vulnerabilities, and suspicious network activity.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">New vulnerabilities appear continuously, and the environment itself keeps changing.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-707cd1c elementor-widget elementor-widget-heading\" data-id=\"707cd1c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What is Network Vulnerability Management?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-97ad744 elementor-widget elementor-widget-text-editor\" data-id=\"97ad744\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Network vulnerability management is the continuous process of discovering network assets, identifying vulnerabilities, assessing their risk, prioritizing remediation, correcting or mitigating weaknesses, verifying fixes, and reassessing the environment as conditions change.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A mature vulnerability management program therefore extends beyond running a monthly vulnerability scan.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">It connects:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><b><span data-contrast=\"auto\">Asset discovery \u2192 Vulnerability assessment \u2192 Risk prioritization \u2192 Remediation \u2192 Validation \u2192 Continuous monitoring<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">This continuous approach is particularly important because both the threat landscape and network environment change. New zero-day vulnerabilities are disclosed, systems are reconfigured, cloud resources are created, users change roles, and attackers adopt new exploitation techniques.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8c25753 elementor-widget elementor-widget-heading\" data-id=\"8c25753\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Does Network Monitoring Help Reduce Vulnerability Risk?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a3480bb elementor-widget elementor-widget-text-editor\" data-id=\"a3480bb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Network vulnerability management and network security management address related but different parts of risk.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A vulnerability scanner can tell the security team: \u201c<em><strong>This server may contain an exploitable weakness.<\/strong><\/em>\u201d<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Network security monitoring can add questions such as:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">\u201cWho is communicating with that server?\u201d<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">\u201cHas its behavior changed?\u201d<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">\u201cIs another system scanning it?\u201d<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">\u201cDid it suddenly begin communicating with new destinations?\u201d<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">\u201cIs traffic suggesting reconnaissance, lateral movement, or command-and-control activity?\u201d<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Consider two servers with the same vulnerability and similar severity scores. The first sits in an isolated segment and shows no unusual traffic.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">The second is internet-facing, has access to sensitive internal infrastructure, and has begun receiving suspicious requests followed by unexpected east-west connections.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">From a vulnerability database perspective, they may look similar. From a security-operations perspective, they clearly deserve different attention.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">This is where network traffic analysis, threat intelligence, vulnerability information and NDR can complement one another. Vulnerability data establishes potential weakness; network telemetry adds behavioral and environmental evidence.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">That additional context can help security teams distinguish a vulnerability waiting in a remediation queue from one that may require immediate investigation.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-071c714 elementor-widget elementor-widget-heading\" data-id=\"071c714\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Related Terms &amp; Synonyms<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e2355db elementor-widget elementor-widget-text-editor\" data-id=\"e2355db\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<ul><li><b><span data-contrast=\"auto\">Network Exposure:<\/span><\/b><span data-contrast=\"auto\"> The extent to which a network asset, service or resource is reachable by users, systems or potential attackers.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network Security Gap:<\/span><\/b><span data-contrast=\"auto\"> A weakness or missing security control that leaves part of the network insufficiently protected.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network Attack Surface:<\/span><\/b><span data-contrast=\"auto\"> The collection of network-accessible assets, services, interfaces and pathways that an attacker could potentially target.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network Threat Exposure:<\/span><\/b><span data-contrast=\"auto\"> The degree to which network systems and assets are accessible to or affected by relevant cyber threats.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network Vulnerability Risk:<\/span><\/b><span data-contrast=\"auto\"> The potential security impact created by a network vulnerability based on factors such as exploitation likelihood, exposure, asset importance and available controls.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Cybersecurity Vulnerability:<\/span><\/b><span data-contrast=\"auto\"> A weakness in technology, processes, controls or implementation that could be exploited or triggered to compromise security.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Infrastructure Vulnerability:<\/span><\/b><span data-contrast=\"auto\"> A weakness affecting underlying IT or operational infrastructure, such as servers, network devices, cloud resources, communications systems or supporting technology.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network Configuration Weakness:<\/span><\/b><span data-contrast=\"auto\"> An insecure or inappropriate setting in network infrastructure that can create unintended access, exposure or trust.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network Security Vulnerability:<\/span><\/b><span data-contrast=\"auto\"> A weakness in network infrastructure, architecture, software, protocols or controls that could be exploited to compromise confidentiality, integrity or availability.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Network Security Misconfiguration:<\/span><\/b><span data-contrast=\"auto\"> An incorrectly or insecurely configured network setting that exposes systems, services or data to unnecessary security risk.<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b9b8efb e-flex e-con-boxed e-con e-parent\" data-id=\"b9b8efb\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a7b41d3 elementor-widget elementor-widget-heading\" data-id=\"a7b41d3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">People Also Ask<\/h2>\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-c2498ac e-con-full e-flex e-con e-child\" data-id=\"c2498ac\" data-element_type=\"container\" data-e-type=\"container\" id=\"faq-section\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b7af59c elementor-widget elementor-widget-n-accordion\" data-id=\"b7af59c\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;default_state&quot;:&quot;expanded&quot;,&quot;max_items_expended&quot;:&quot;one&quot;,&quot;n_accordion_animation_duration&quot;:{&quot;unit&quot;:&quot;ms&quot;,&quot;size&quot;:400,&quot;sizes&quot;:[]}}\" data-widget_type=\"nested-accordion.default\">\n\t\t\t\t\t\t\t<div class=\"e-n-accordion\" aria-label=\"Accordion. Open links with Enter or Space, close with Escape, and navigate with Arrow Keys\">\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1920\" class=\"e-n-accordion-item\" open>\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"1\" tabindex=\"0\" aria-expanded=\"true\" aria-controls=\"e-n-accordion-item-1920\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 1. What is vulnerability in network security? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1920\" class=\"elementor-element elementor-element-7f4aa81 e-con-full e-flex e-con e-child\" data-id=\"7f4aa81\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1920\" class=\"elementor-element elementor-element-0a80958 e-flex e-con-boxed e-con e-child\" data-id=\"0a80958\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-afe789b elementor-widget elementor-widget-text-editor\" data-id=\"afe789b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">A vulnerability in network security is a weakness in network hardware, software, configuration, architecture, access controls or security processes that could be exploited to gain unauthorized access, disrupt services, intercept information or compromise connected systems.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Examples include an unpatched firewall, an exposed management interface, weak authentication, poor segmentation and an insecure network configuration.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">The vulnerability is the weakness itself. The attacker, malware or technique that exploits it represents the threat.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1921\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"2\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1921\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 2. What makes a network vulnerable to interception? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1921\" class=\"elementor-element elementor-element-0cb3db5 e-con-full e-flex e-con e-child\" data-id=\"0cb3db5\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1921\" class=\"elementor-element elementor-element-f66bb0a e-flex e-con-boxed e-con e-child\" data-id=\"f66bb0a\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a341ecb elementor-widget elementor-widget-text-editor\" data-id=\"a341ecb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">A network becomes more vulnerable to interception when traffic or authentication information can be observed, redirected or manipulated by an unauthorized party.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Factors that increase this risk include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">unencrypted network traffic;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">open or poorly secured Wi-Fi;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">outdated encryption protocols;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">weak <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/Security\/Practical_implementation_guides\/TLS\" target=\"_blank\" rel=\"noopener nofollow\">TLS configurations<\/a>;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">insecure legacy protocols;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">compromised routers or network devices;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">rogue wireless access points;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">weak VPN configurations;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">inadequate certificate validation; and<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">attacks that manipulate local network communications or name resolution.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Public and otherwise untrusted networks deserve particular caution because users generally do not control the network infrastructure between their device and the destination.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Encryption protects against many interception scenarios by making captured data significantly less useful to an unauthorized observer.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1922\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"3\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1922\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 3. What are common security vulnerabilities in enterprise networks?  <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1922\" class=\"elementor-element elementor-element-5813b56 e-con-full e-flex e-con e-child\" data-id=\"5813b56\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1922\" class=\"elementor-element elementor-element-d9f0ad3 e-flex e-con-boxed e-con e-child\" data-id=\"d9f0ad3\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-eb79a0d elementor-widget elementor-widget-text-editor\" data-id=\"eb79a0d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Common vulnerabilities in enterprise networks include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">unpatched operating systems and network devices;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">vulnerable VPN and firewall appliances;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">network misconfigurations;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">exposed ports and administrative services;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">weak or reused credentials;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">missing multifactor authentication;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">excessive privileges;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">poor network segmentation;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">insecure legacy protocols;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">misconfigured cloud network controls;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">unmanaged IoT and OT devices;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">outdated firmware; and<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">unknown or shadow assets.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Enterprise environments can also become vulnerable through excessive trust between systems. A device may be well protected individually but still create risk if compromise provides unrestricted access to other parts of the environment.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1923\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"4\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1923\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 4. What are the best tools to scan for network vulnerabilities?  <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1923\" class=\"elementor-element elementor-element-38bd880 e-con-full e-flex e-con e-child\" data-id=\"38bd880\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1923\" class=\"elementor-element elementor-element-f75101f e-flex e-con-boxed e-con e-child\" data-id=\"f75101f\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1ae8c5a elementor-widget elementor-widget-text-editor\" data-id=\"1ae8c5a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">The best network vulnerability assessment tools depend on the size of the environment, deployment model, asset types, compliance requirements and how vulnerability data needs to integrate with remediation workflows.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Commonly used options include Tenable Nessus, Qualys VMDR, Rapid7 Vulnerability Management (InsightVM) and Greenbone\/OpenVAS.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Tenable Nessus scans for issues including missing patches, flaws and misconfigurations, while Qualys VMDR combines asset discovery, vulnerability and configuration assessment, prioritization and remediation workflows. Rapid7&#8217;s platform provides network scanning and risk-based vulnerability management, while OpenVAS is part of Greenbone&#8217;s vulnerability-management ecosystem.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">The tool itself is only part of the decision. Organizations should consider whether they need:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">authenticated and unauthenticated scanning;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">internal and external scanning;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">cloud and hybrid coverage;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">network-device assessment;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">configuration checks;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">CVE and CVSS support;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">exploit and threat intelligence;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">asset discovery;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">remediation integrations; and<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">risk-based prioritization.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">For larger environments, a strong vulnerability assessment program typically uses scanning alongside asset management, threat intelligence, penetration testing, and security monitoring rather than treating one scanner as the complete solution.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1924\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"5\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1924\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 5. What is the difference between vulnerabilities and threats?  <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1924\" class=\"elementor-element elementor-element-606f103 e-con-full e-flex e-con e-child\" data-id=\"606f103\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1924\" class=\"elementor-element elementor-element-9ac2c15 e-flex e-con-boxed e-con e-child\" data-id=\"9ac2c15\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-da93424 elementor-widget elementor-widget-text-editor\" data-id=\"da93424\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">A vulnerability is a weakness that could be exploited. A threat is something capable of exploiting or triggering that weakness and causing harm.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">For example:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">An unpatched VPN appliance is a <\/span><b><span data-contrast=\"auto\">vulnerability<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">A threat actor targeting that appliance is a <\/span><b><span data-contrast=\"auto\">threat<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Code used to compromise the appliance is an <\/span><b><span data-contrast=\"auto\">exploit<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Successful access through the appliance is <\/span><b><span data-contrast=\"auto\">vulnerability exploitation<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Malware, ransomware, phishing, and malicious insiders are therefore better understood as threats or attack mechanisms rather than vulnerabilities themselves.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">The distinction matters because eliminating every cyber threat is impossible. Organizations instead reduce risk by removing vulnerabilities, reducing exposure, limiting attacker access, and detecting malicious activity.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1925\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"6\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1925\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 6. Which type of network is most vulnerable to intrusion?  <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1925\" class=\"elementor-element elementor-element-fc973b2 e-con-full e-flex e-con e-child\" data-id=\"fc973b2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1925\" class=\"elementor-element elementor-element-bdc6450 e-flex e-con-boxed e-con e-child\" data-id=\"bdc6450\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a802f44 elementor-widget elementor-widget-text-editor\" data-id=\"a802f44\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">There is no single network type that is automatically the most vulnerable to <a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/network-intrusion\/\" target=\"_blank\" rel=\"noopener\">intrusion<\/a>. Risk depends more on architecture, configuration, exposure, and security controls than on whether a network is classified as wired, wireless, cloud, or on-premises.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">However, networks are generally more susceptible when they have characteristics such as:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">open or weakly secured wireless access;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">internet-exposed services;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">weak authentication;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">outdated systems;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">insecure protocols;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">poor monitoring;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">flat network architecture;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">little or no segmentation; and<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">broad trust between systems.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Open public Wi-Fi can be particularly exposed to local interception risks because users do not control the underlying network and may share connectivity with unknown devices.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Within enterprise environments, a poorly segmented or \u201cflat\u201d network can be especially damaging after an intrusion because a compromised device may provide an attacker with easier access to additional systems.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<script type=\"application\/ld+json\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"1. What is vulnerability in network security?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"A vulnerability in network security is a weakness in network hardware, software, configuration, architecture, access controls or security processes that could be exploited to gain unauthorized access, disrupt services, intercept information or compromise connected systems.\\u00a0Examples include an unpatched firewall, an exposed management interface, weak authentication, poor segmentation and an insecure network configuration.\\u00a0The vulnerability is the weakness itself. The attacker, malware or technique that exploits it represents the threat.\"}},{\"@type\":\"Question\",\"name\":\"2. What makes a network vulnerable to interception?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"A network becomes more vulnerable to interception when traffic or authentication information can be observed, redirected or manipulated by an unauthorized party.\\u00a0Factors that increase this risk include:\\u00a0unencrypted network traffic;\\u00a0open or poorly secured Wi-Fi;\\u00a0outdated encryption protocols;\\u00a0weak TLS configurations;\\u00a0insecure legacy protocols;\\u00a0compromised routers or network devices;\\u00a0rogue wireless access points;\\u00a0weak VPN configurations;\\u00a0inadequate certificate validation; and\\u00a0attacks that manipulate local network communications or name resolution.\\u00a0Public and otherwise untrusted networks deserve particular caution because users generally do not control the network infrastructure between their device and the destination.\\u00a0Encryption protects against many interception scenarios by making captured data significantly less useful to an unauthorized observer.\"}},{\"@type\":\"Question\",\"name\":\"3. What are common security vulnerabilities in enterprise networks?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Common vulnerabilities in enterprise networks include:\\u00a0unpatched operating systems and network devices;\\u00a0vulnerable VPN and firewall appliances;\\u00a0network misconfigurations;\\u00a0exposed ports and administrative services;\\u00a0weak or reused credentials;\\u00a0missing multifactor authentication;\\u00a0excessive privileges;\\u00a0poor network segmentation;\\u00a0insecure legacy protocols;\\u00a0misconfigured cloud network controls;\\u00a0unmanaged IoT and OT devices;\\u00a0outdated firmware; and\\u00a0unknown or shadow assets.\\u00a0Enterprise environments can also become vulnerable through excessive trust between systems. A device may be well protected individually but still create risk if compromise provides unrestricted access to other parts of the environment.\"}},{\"@type\":\"Question\",\"name\":\"4. What are the best tools to scan for network vulnerabilities?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The best network vulnerability assessment tools depend on the size of the environment, deployment model, asset types, compliance requirements and how vulnerability data needs to integrate with remediation workflows.\\u00a0Commonly used options include Tenable Nessus, Qualys VMDR, Rapid7 Vulnerability Management (InsightVM) and Greenbone\\\/OpenVAS.\\u00a0Tenable Nessus scans for issues including missing patches, flaws and misconfigurations, while Qualys VMDR combines asset discovery, vulnerability and configuration assessment, prioritization and remediation workflows. Rapid7&#8217;s platform provides network scanning and risk-based vulnerability management, while OpenVAS is part of Greenbone&#8217;s vulnerability-management ecosystem.\\u00a0The tool itself is only part of the decision. Organizations should consider whether they need:\\u00a0authenticated and unauthenticated scanning;\\u00a0internal and external scanning;\\u00a0cloud and hybrid coverage;\\u00a0network-device assessment;\\u00a0configuration checks;\\u00a0CVE and CVSS support;\\u00a0exploit and threat intelligence;\\u00a0asset discovery;\\u00a0remediation integrations; and\\u00a0risk-based prioritization.\\u00a0For larger environments, a strong vulnerability assessment program typically uses scanning alongside asset management, threat intelligence, penetration testing, and security monitoring rather than treating one scanner as the complete solution.\"}},{\"@type\":\"Question\",\"name\":\"5. What is the difference between vulnerabilities and threats?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"A vulnerability is a weakness that could be exploited. A threat is something capable of exploiting or triggering that weakness and causing harm.\\u00a0For example:\\u00a0An unpatched VPN appliance is a vulnerability.\\u00a0A threat actor targeting that appliance is a threat.\\u00a0Code used to compromise the appliance is an exploit.\\u00a0Successful access through the appliance is vulnerability exploitation.\\u00a0Malware, ransomware, phishing, and malicious insiders are therefore better understood as threats or attack mechanisms rather than vulnerabilities themselves.\\u00a0The distinction matters because eliminating every cyber threat is impossible. Organizations instead reduce risk by removing vulnerabilities, reducing exposure, limiting attacker access, and detecting malicious activity.\"}},{\"@type\":\"Question\",\"name\":\"6. Which type of network is most vulnerable to intrusion?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"There is no single network type that is automatically the most vulnerable to intrusion. Risk depends more on architecture, configuration, exposure, and security controls than on whether a network is classified as wired, wireless, cloud, or on-premises.\\u00a0However, networks are generally more susceptible when they have characteristics such as:\\u00a0open or weakly secured wireless access;\\u00a0internet-exposed services;\\u00a0weak authentication;\\u00a0outdated systems;\\u00a0insecure protocols;\\u00a0poor monitoring;\\u00a0flat network architecture;\\u00a0little or no segmentation; and\\u00a0broad trust between systems.\\u00a0Open public Wi-Fi can be particularly exposed to local interception risks because users do not control the underlying network and may share connectivity with unknown devices.\\u00a0Within enterprise environments, a poorly segmented or \\u201cflat\\u201d network can be especially damaging after an intrusion because a compromised device may provide an attacker with easier access to additional systems.\"}}]}<\/script>\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>What is Network Vulnerability? Network vulnerability is a weakness in a network&#8217;s hardware, software, configuration, architecture, protocols, or security controls that could be exploited by an attacker to gain unauthorized access, disrupt operations, move between systems, or compromise data.\u00a0 NIST broadly defines vulnerability as a weakness in an information system, security procedure, internal control, or [&hellip;]<\/p>\n","protected":false},"featured_media":20107,"template":"","class_list":["post-20106","glossary","type-glossary","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.netwitness.com\/ko\/wp-json\/wp\/v2\/glossary\/20106","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.netwitness.com\/ko\/wp-json\/wp\/v2\/glossary"}],"about":[{"href":"https:\/\/www.netwitness.com\/ko\/wp-json\/wp\/v2\/types\/glossary"}],"version-history":[{"count":11,"href":"https:\/\/www.netwitness.com\/ko\/wp-json\/wp\/v2\/glossary\/20106\/revisions"}],"predecessor-version":[{"id":21301,"href":"https:\/\/www.netwitness.com\/ko\/wp-json\/wp\/v2\/glossary\/20106\/revisions\/21301"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.netwitness.com\/ko\/wp-json\/wp\/v2\/media\/20107"}],"wp:attachment":[{"href":"https:\/\/www.netwitness.com\/ko\/wp-json\/wp\/v2\/media?parent=20106"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}