Glossary · MWE Terms · V
L1 — paginated flat list. Pick a POS, pick a letter.
TermTypeDefinitionClassificationsUpdated
vulnerability informationnounMWEActionable intelligence about identified weaknesses in systems, products, or processes — encompassing details such as flaw descriptions, severity ratings, affected components, and steps needed to exploit or remediate the weakness. Authority documents across the field treat it as a broad input category to risk management: NIST SP 800-53 repeatedly pairs it with threat information as a refined input that "facilitates the selection of additional security controls" and as a basis to "appropriately modify the controls based on… known threat and vulnerability information." CIS Controls likewise directs defenders to "monitor public and private industry sources for new threats and vulnerability information" as a continuous feed into vulnerability management. At its most specific, NIST's CSRC glossary also recognizes a narrower subtype — *technical* vulnerability information — defined as a "detailed description of a weakness to include the implementable steps… necessary to exploit that weakness," confirming that the broader expression subsumes multiple levels of detail, from high-level advisories through full exploitation guidance.verified
Vulnerability Management plannounMWEThis purpose of this plan is to establish the organization's assessment and testing process to ensure systems are less susceptible to cyber attack.verified
vulnerability mitigationnounMWEThe purpose of this task is to prioritize, evaluate, and implement measures and controls to counteract a weakness or vulnerability.verified
vulnerability scannounMWEThe check of a system for known vulnerabilities from beginning to end with resultant errors, and status information.verified
Vulnerability scanningnounMWEAn automated process to proactively identify security weaknesses in a network or individual systemverified
vulnerability scanning parameternounMWEA configurable attribute or setting that governs the behavior of a vulnerability scanning process — such as scan scope (IP ranges, ports, or asset types), scan frequency, authentication credentials, scanning depth, and included or excluded checks. Standards and compliance frameworks treat these settings as security-relevant information, because their unauthorized disclosure or modification could allow an adversary to evade detection or narrow the scan's coverage. In practice, documents such as NIST SP 800-171r3 group them alongside intrusion-detection parameters and filtering rules as items requiring access controls and least-privilege protections.verified