# Exploit

**What is an exploit?**

An exploit is the code that actually takes advantage of a weakness. The weakness is the flaw in the program. The exploit is the tool that turns it into access.

The distinction matters when judging risk. A known weakness for which no exploit is circulating is rarely attacked. As soon as a working exploit is publicly available the situation changes, because attackers without skills of their own can then work with it.

For that reason it is not enough to sort weaknesses by severity alone. A medium weakness that is being actively exploited is more urgent than a critical one for which no tool exists.

In practice that means systems reachable from the internet need their updates first. That is where the path between a published exploit and your business is shortest.

## Related terms
- [Vulnerability and vulnerability assessment](https://vetosec.at/en/it-security/schwachstelle/)
- [Zero-day vulnerability](https://vetosec.at/en/it-security/zero-day/)
- [Patch management and updates](https://vetosec.at/en/it-security/patch-management/)
- [Vulnerability scan](https://vetosec.at/en/it-security/schwachstellenscan/)

## Source
https://vetosec.at/en/it-security/exploit/ (vetosec, angriffe)