Vulnerabilities in Systems and Processes

A vulnerability is a weakness in a system, process, policy or behaviour that a threat actor could exploit to cause harm. Vulnerabilities are the gaps through which threats pass. Reducing vulnerabilities is one of the primary goals of any security programme, and it is an area where managers at every level of an organisation have a meaningful role to play.

It is important to understand that vulnerabilities are not only technical. The most sophisticated firewall in the world cannot protect an organisation from a member of staff who shares their password, uses an unapproved application to process sensitive data, or transfers confidential files to their personal email before leaving the organisation. Technical vulnerabilities are managed by IT and security teams; human and process vulnerabilities are managed, in large part, by managers.

Technical Vulnerabilities

• Unpatched software and systems: when software developers identify security flaws in their products, they release patches or updates to fix them. Organisations that do not apply those patches promptly leave known vulnerabilities open for attackers to exploit. The median time for organisations to fully remediate vulnerabilities in perimeter devices was found to be 32 days in the Verizon 2025 DBIR. Given that attackers routinely begin scanning for newly disclosed vulnerabilities within hours of public disclosure, 32 days represents a significant window of exposure.
• Weak authentication: passwords that are easily guessed, reused across multiple accounts, or shared between team members are a primary attack surface. The Verizon 2025 DBIR found stolen credentials were used in 22 per cent of breaches and in 88 per cent of basic web application attacks. Multi-factor authentication (MFA) significantly reduces this risk but is not universally deployed, and increasingly sophisticated techniques such as MFA prompt bombing and session token theft are being used to bypass it where it is.
• Misconfigured systems: security controls that are incorrectly configured can create significant vulnerabilities even when the underlying technology is sound. The Capital One breach studied in Week 2 is a classic example: the vulnerability was not a flaw in the technology but in its configuration. Cloud environments in particular introduce configuration complexity that can create unexpected exposures if not carefully managed.
• Legacy systems and end-of-life software: systems that are no longer supported by their developers do not receive security patches, meaning that vulnerabilities discovered after the end-of-support date cannot be addressed through normal update processes. Organisations that continue to operate unsupported systems face an increasing accumulation of unaddressed vulnerabilities over time.
• Unsecured devices: the Verizon 2025 DBIR found that 46 per cent of compromised business credentials came from non-managed (personal or bring-your-own-device) devices. When employees access corporate systems and data from devices that are not managed by the organisation, the organisation has limited visibility and control over the security of those devices.

Human and Behavioural Vulnerabilities

• Susceptibility to phishing: despite widespread awareness training, click rates on phishing simulations remain stubbornly consistent. The Verizon 2025 DBIR noted that phishing failure rates are largely unaffected by standard awareness training, suggesting that training alone is insufficient and that technical controls, clear reporting processes and a non-punitive culture are equally important.
• Poor password hygiene: reuse of passwords across personal and professional accounts means that a breach of a consumer service such as a shopping website or social media platform can yield credentials that work on corporate systems. Credential stuffing attacks systematically test large volumes of leaked credentials against corporate login pages.
• Oversharing and data handling errors: sending emails to the wrong recipient, attaching the wrong document, sharing access to a file with an unintended audience or discussing sensitive matters in public or on unsecured channels are all common sources of data breaches. These errors are not a reflection of poor intent; they reflect the pressures of busy working environments and the absence of clear, friction-reducing processes.
• Failure to report incidents: when individuals do not feel safe reporting suspected security incidents, whether because they fear blame, embarrassment or professional consequences, the window for effective response is significantly reduced. The average time for a breach to be identified and contained is 73 days according to IBM. A culture in which concerns are reported promptly can significantly reduce this dwell time.

Process and Governance Vulnerabilities

• Inadequate access management: the persistence of user accounts belonging to former employees, the granting of excessive access rights, and the absence of regular access reviews are among the most commonly exploited process vulnerabilities. Each represents an opportunity for both external attackers and insider threats.
• Absent or unenforced policies: organisations that have security policies that are not communicated to staff, not understood, or not consistently enforced experience the worst of both worlds: the compliance overhead of maintaining documentation alongside the security exposure of having policies that do not influence behaviour.
• Unclear incident reporting routes: if staff do not know how to report a security concern, whether because the process has never been communicated or because previous reports were handled badly, incidents go unreported and unaddressed.
• Vendor due diligence gaps: organisations that do not assess the security practices of their suppliers or do not include appropriate security requirements in their contracts create vulnerabilities in their extended ecosystem.

Insight: The Relationship Between Vulnerabilities and Attack Vectors

It is worth pausing to reflect on the relationship between the threat categories discussed in Step 1 and the vulnerabilities described here. Phishing attacks succeed because of human behavioural vulnerabilities. Ransomware frequently enters organisations through phishing emails or unpatched systems. Credential attacks exploit weak authentication practices. Supply chain attacks exploit inadequate vendor due diligence. In almost every case, the most effective defences address both the technical and the human or process dimensions simultaneously.

Managers cannot address technical vulnerabilities directly in most cases, but they can address human and process vulnerabilities every day. Promoting a reporting culture, ensuring offboarding procedures are followed, reviewing access rights regularly, enforcing clear desk policies and modelling secure behaviour in their own work are all within every manager’s reach.

For more information, click here and here