Managing Risk in Information Systems, 3rd Edition

Exploit Assessments

Exploit assessments attempt to exploit vulnerabilities. In other words, they simulate an attack to determine whether the attack can succeed. An exploit test usually starts with a vulnerability test to determine the vulnerabilities, which is followed by an attempt to exploit the vulnerabilities.

Many large organizations have dedicated security teams used to perform exploit assessments. Others hire outside professionals. These personnel spend close to 100 percent of their work time learning about vulnerabilities and exploits. They learn how to identify the vulnerabilities and how to exploit them. They also learn what is needed to protect an organization from the exploits.

Unless someone is a security professional focused ...