Exploit
Also known as: software exploit, security exploit, exploit code
An exploit is a piece of code, a command, or a technique that takes advantage of a vulnerability in software or hardware to make it behave in unintended ways, such as letting an attacker run their own code, gain higher privileges, or steal data.
A vulnerability is the weakness; an exploit is the tool that uses it. While publishing exploits helps defenders test their systems, public exploit code also lets less skilled criminals attack unpatched systems quickly.
Exploit, explained at three levels
At home
If a vulnerability is an unlocked window, an exploit is the method a burglar uses to climb through it. Updates close the window so the exploit no longer works.
At work
When an exploit for a flaw becomes public, unpatched systems face attacks quickly, so patching urgency rises sharply.
At home
Some exploits need you to open a file or click a link. Others work just by visiting a website or receiving a message, which is why updates for browsers and phones matter so much.
At work
Exploits vary by impact (remote code execution, privilege escalation, data disclosure) and reliability. Exploit kits package several exploits to attack visitors to malicious websites. Security teams track proof-of-concept releases as a trigger for emergency patching.
At home
Modern phones and browsers use defences that make exploits much harder to build. In my opinion, that's why the most dangerous exploits now sell for millions of dollars.
At work
Mitigations include rapid patching, exploit-resistant configurations, memory protection features, application allow-listing, endpoint detection, and network segmentation to limit what a successful exploit can reach. Virtual patching through WAFs or IPS can buy time.
Real-world examples
At home
Carlos's phone prompted him to install an urgent update. The release notes said it fixed a flaw that was already being exploited, so he installed it right away.
At work
Aisha is a security analyst at a Winnipeg manufacturer. When a public exploit appeared for the company's VPN appliance, she patched it that night instead of waiting for the monthly window.
How it compares
| feature | Exploit | Vulnerability |
|---|---|---|
| What it is | The method or code that attacks | The weakness |
| Exists without the other | No, needs a vulnerability | Yes, may never be exploited |
| Fixed by | Patching the vulnerability | Patching or configuration |
| Urgency signal | Public exploit means act fast | Depends on exposure |
A vulnerability is the hole. An exploit is the crowbar.
For analysts
I'd make 'public exploit available' an automatic trigger for faster patching in IT policy. That single rule closes many windows attackers rely on.
History & origin
Early exploits were shared among hackers in the 1980s and 1990s, and the 1996 article 'Smashing the Stack for Fun and Profit' by Elias Levy, writing as Aleph One, explained buffer overflow exploits widely. The open-source Metasploit Framework, created by H.D. Moore in 2003, made exploits easy to use for penetration testers, and for attackers. Exploit markets grew, with brokers paying large sums for zero-day exploits. In 2017, the leaked NSA exploit EternalBlue was used in the WannaCry and NotPetya attacks, causing billions of dollars in damage. Today, the time between a flaw's disclosure and its exploitation is often measured in days. In my view, EternalBlue showed that governments hoarding exploits can end up arming criminals.