Secordit home
Contact

What is a vulnerability?

A vulnerability is a weakness in an IT system that an attacker can exploit. The NCSC says it may come from a flaw, meaning unintended behaviour, from a feature that can be misused, or from a user mistake. Examples of a user mistake include a weak or reused password, or leaving a device without a lock. 12

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. A weakness exists in software, a configuration, or the way a system is used. 1
  2. An attacker finds a way to exploit it. Once the weakness is known, vendors often issue a security update. 12
  3. Applying those updates, and knowing what devices you have, is the practical response for most people and small organisations. 21

How it can look

The NCSC also has a route for researchers who find and report vulnerabilities. Ordinary readers should not test other people's systems. 31

Warning signs

  • A vendor or a trusted security source says a weakness has been found in software you use. An update is available, but it has not been applied. 21
  • A device, app or system is still in use after support, and therefore after security fixes, has ended. 2
  • A weak or reused password is still in place, or a device is left without a lock in a shared space. 1

What to do now

  1. When a company says a security vulnerability has been found in an app or device you use, apply the vendor's update. Use the genuine site or store. 21
  2. Keep a simple list of the devices and software you rely on, so you can see what still receives updates. 2
  3. Do not try to test weaknesses on other people's systems. Researchers have an NCSC reporting route for that work. 3

UK reporting and support

  • If you are a researcher reporting a vulnerability, use the NCSC vulnerability-reporting route. 3
  • If you think a device is infected or an account has been taken over, follow the NCSC help for individuals. 4
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 567
  • If someone is in danger, call 999. 67

How to protect yourself

  • Apply software updates when they appear, and turn on automatic updates where you can. 2
  • Use unique passwords and MFA or passkeys, and lock devices when you are not using them. 1
  • Replace devices that no longer receive security updates with a supported model. 2

Frequently asked questions

What does it mean when a company says a security vulnerability has been found in an app I use?

It means a weakness has been identified that an attacker could exploit. Vendors often issue a security update once the weakness is known. Apply that update through the genuine app store or vendor site. 12

Is a vulnerability always a software bug?

No. The NCSC says it may come from a flaw, a feature that can be misused, or a user mistake. Examples include a weak or reused password, or a device left without a lock. 1

Should I try to find weaknesses in other people's systems?

No. Finding and reporting vulnerabilities has an NCSC route for researchers. Ordinary readers should not test other people's systems. 3

Matching kit

First Hour After a Breach · £29 · Digital download.

An incident-response planning kit for UK small businesses. It is not a live incident-response or legal service.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Understanding vulnerabilities | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  2. NCSC, 10 Steps: Vulnerability management | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. NCSC, Vulnerability reporting | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. NCSC, Help for individuals | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  5. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  6. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  7. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).