Exploits, Vulnerabilities, and Threat Adaptation

Originally published on LevelBlue

Security — whether physical, cyber, or operational — is an interesting topic that lends itself to considerable debate. There are, however, basic concepts and underpinnings that pervade all security theory. Among the most important, yet often misunderstood, are the inextricably entwined concepts of vulnerabilities and exploits.

Security Is Not Binary

First, security cannot be considered a binary concept such as "secure" or "not secure." The appropriateness of any security strategy is relative to the controls implemented to address identified risks. One cannot say: "My house is secure." One can say: "My house has been secured in a manner commensurate with the identified risks."

Second, security should be viewed as a function of time and resources — expressed as S = f(T × R). Security in any domain can never be fully "assured" or "guaranteed" because technologies change and human threats are adaptive.

The Department of Homeland Security defines Adaptive Threats as:

"...threats intentionally caused by humans...caused by people that can change their behavior or characteristics in reaction to prevention, protection, response, and recovery measures taken."

Defining Vulnerabilities and Exploits

Vulnerability: A characteristic of design, location, security posture, or operation that renders an asset susceptible to disruption, destruction, or exploitation. Succinctly: a vulnerability is a susceptibility to a given, identified exploit.

Exploit: Something that takes advantage of a bug or vulnerability to cause unintended behavior. An exploit is a technique, tactic, or technology that can circumvent a control designed to protect against it. Succinctly: an exploit is something that gains advantage of a susceptibility in a control.

These two concepts are intentionally circular — they are not mutually independent. One can only exist, in theory, without knowledge of the other.

The Bank Vault Thought Experiment

Consider a modern UL608 Class 3 bank vault rated to withstand 120 minutes of "torch and tools." The steel's melting point is the vulnerability; the cutting torch is the exploit. Now transport that vault 3,000 years back to the Bronze Age. Iron had not yet been discovered. Steel was 1,000 years away. There was no mechanism to create sufficient heat to test the vault — no known exploits, no known vulnerabilities. Yet the vulnerability still existed; it simply hadn't been discovered yet.

This is a critical concept: the existence of a vulnerability does not depend on whether it has been identified.

Threat Adaptation in Practice

In 1977, IBM's Data Encryption Standard (DES) approached mathematical impossibility to crack. By 1997, increased computing power allowed it to be broken for the first time. By 2017, a rainbow table attack recovered a DES key in 25 seconds.

Similarly, SSL v2, long used to protect payment data, was revealed in 2016 to contain a previously unknown vulnerability known as "BEAST." Until that weakness was discovered and an exploit created, they existed in theory only.

This is threat adaptation in action: as knowledge and technology advance, previously theoretical exploits become real. As defenses improve, attackers adapt — and the cycle continues indefinitely.

Conclusion

Organizations that understand the foundational theory of exploits, vulnerabilities, and threat adaptation are better equipped to implement controls that are truly commensurate with their risks — saving time, money, and effort while building a more resilient security posture.