Exploit
An exploit is a piece of code or a technique that takes advantage of a security flaw in software to make it do something its makers never intended, such as letting an attacker in. Cyber Essentials v3.3 counters exploits through security update management: critical and high-risk fixes within 14 days (A6.4, A6.5) and removal of unsupported software (A6.6).
- Term
- Exploit
- Also known as
- Exploitation, Exploit code
- Category
- Malware, cloud and threats
- Requirement area
- 3. Security Update Management
- Questions
- A6.4AUTO-FAILA6.5AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term exploit mean in Cyber Essentials?
An exploit is a piece of code or a technique that takes advantage of a security flaw in software to make it do something its makers never intended, such as letting an attacker in.
Once discovered, malicious individuals or groups move quickly to misuse (or ‘exploit’) vulnerabilities to attack computers and networks.
How does exploit apply to Cyber Essentials?
In plain terms
A vulnerability is a faulty lock. An exploit is the specific trick or tool that opens it. Once a flaw becomes known, criminals can build an exploit and use it against anyone who has not yet fitted the new lock, which is what a security update is.
What Cyber Essentials asks
The security update management control exists because of exploits. The requirements describe the race in the wording quoted above, and the rule that follows is that software must be "updated, including vulnerability fixes, within 14 days of release" where the vendor rates the fix critical or high risk, where it has a CVSS v3 base score of 7 or above, or where the vendor gives no severity details. On the 14 days, the NCSC says: "Any longer would constitute a serious security risk while a shorter period may not be practical."
A6.4 covers operating systems and router and firewall firmware, and A6.5 all other software. Both are automatic fails if answered No. A6.6 asks whether unsupported software has been removed, because it will never get a fix.
Cyber Essentials Plus test case 2 looks for missing fixes "that could be exploited within the bounds of the CE threat model", and the assessor considers "if an internet-based attacker really could exploit it and harm the Applicant."
Common mistakes
- Waiting for a monthly maintenance window when a critical fix is released. The 14 days run from release.
- Assuming a device is safe because it sits behind a firewall. Email attachments and web pages reach devices through the firewall.
See the security update management requirements. Related: zero-day, CVE, vulnerability fixes.
Related terms
- Zero-day vulnerabilityA zero-day is a security flaw that attackers know about and can use before the software maker has released a fix, so defenders have had zero days to patch it.
- CVE (Common Vulnerabilities and Exposures)A CVE is a unique public reference number given to a known security flaw, so vendors, scanners and IT teams can all refer to the same problem.
- Vulnerability fixesVulnerability fixes are patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability.
- Full-disk encryptionFull-disk encryption scrambles everything stored on a laptop, desktop or phone so the data cannot be read without unlocking the device first.
- IaaS (Infrastructure as a Service)Infrastructure as a Service (IaaS) is renting virtual servers and networks from a cloud provider, which your organisation then sets up and looks after much as it would physical equipment.
- MalwareMalware is software that someone has written and spread on purpose to cause harm, such as computer viruses, worms and ransomware.
Frequently asked questions
An exploit is a piece of code or a technique that takes advantage of a security flaw in software to make it do something its makers never intended, such as letting an attacker in. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, exploit comes up at A6.4, A6.5. Read those questions against the definition above so your answers use the term the way the assessor will.
Exploit relates to 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.