Vulnerability
In one sentence
A weakness in software or a system that an attacker can exploit to get in or cause harm.
A vulnerability is a flaw that can be abused: a coding bug, a misconfiguration, a default password. Vulnerability management is the ongoing work of finding and fixing them, often via scanning and patching.
Why it's on your cyber insurance application
Rarely asked as a word of its own, but it sits under the patching and end-of-life questions, and some carriers run their own external scan of your internet-facing systems before quoting. What they find there, you will be asked about.
What this looks like in practice
Most of what gets exploited at small-business scale isn't exotic. It's a firewall with a default password, an internet-facing server two versions behind, a plugin on a website nobody has logged into for a year. Knowing what you have is half the work, which is why the asset inventory and the patch cadence end up being the real answer.
How the Readiness Check scores it
The free Check asks the same question a carrier will. Here it is, why it's asked, and the fix if today's honest answer is no. The full application question list has the rest.
Patching & vulnerabilities
How are security updates applied to your systems and software?
Why carriers ask: Unpatched, internet-facing software is now a leading initial-access vector. Applications ask about patch cadence and end-of-life systems specifically.
If the answer is no: Have whoever manages IT produce a list of what's patched automatically vs. manually. That list becomes your patch-management policy's appendix.
The written evidence carriers accept
A “yes” on the application needs a document behind it. In the Readiness Pack, that document is:
Related terms
Would you pass this question today?
The free Readiness Check scores you across the ten control domains carriers probe, in five minutes, no email required for the score.