# What is an exploit? Learn what an exploit is, the types of exploits, and how it leverages vulnerabilities to compromise systems. Discover key mitigation strategies to stay secure. [Vincent Delitz](https://www.linkedin.com/in/vincent-delitz/) Created: December 17, 2024 Updated: May 12, 2026 ## Table of Contents ### Buy vs. Build Guide Practical guidance, rollout patterns and KPIs for passkey programs. Practical guidance, rollout patterns and KPIs for passkey programs. [Get Whitepaper](/content/blog/passkeys-buy-vs-build-guide/index.html) --- ## What is an Exploit? An **exploit** is a piece of software, a sequence of commands, or a technique that takes advantage of a [vulnerability](/content/glossary/vulnerability/index.html) or flaw in a system, software, or hardware to achieve unintended or unauthorized behavior. Exploits are commonly used by attackers to gain unauthorized access, manipulate systems, or execute malicious code. Exploits are a critical concept in cybersecurity, as they represent the practical use of [vulnerabilities](/content/glossary/vulnerability/index.html) discovered in a system, turning them into tools for attack. ## Key Characteristics of an Exploit - **Targets Vulnerabilities**: Exploits take advantage of flaws or weaknesses in software, hardware, or systems. - **Automated or Manual**: They can be executed manually by attackers or automated via exploit kits. - **Malicious Intent**: Often used for unauthorized access, data theft, or deploying [malware](/content/glossary/malware/index.html). - **Impact**: Successful exploitation can result in privilege escalation, data breaches, or complete system compromise. ## Key Takeaways - An **exploit** leverages [vulnerabilities](/content/glossary/vulnerability/index.html) in systems, software, or hardware to achieve unauthorized actions. - Exploits can be used for malicious purposes, including data theft, [malware](/content/glossary/malware/index.html) deployment, or system control. - Patching [vulnerabilities](/content/glossary/vulnerability/index.html) is critical to prevent exploits from being successful. --- ## Types of Exploits Exploits can be categorized into several types based on their usage and the systems they target: 1. **Zero-Day Exploits** These are exploits that target previously unknown vulnerabilities. Since there are no patches available, they pose significant risks. 2. **Known Exploits** Exploits that target already discovered vulnerabilities, for which patches or fixes may exist. These are often automated and included in **exploit kits**. 3. **Remote Exploits** Allow attackers to exploit vulnerabilities over a network, often without direct access to the target system. 4. **Local Exploits** Require attackers to have some form of access to the target system, such as low-level user privileges, before exploiting vulnerabilities for privilege escalation. 5. **Browser Exploits** Target vulnerabilities in web browsers or browser plugins, often used to deliver [malware](/content/glossary/malware/index.html) via malicious websites. 6. **Denial-of-Service (DoS) Exploits** Exploits that target vulnerabilities to overwhelm a system, rendering it unavailable to users. ## Mitigation Strategies To protect systems from exploits, organizations should adopt the following strategies: - **Regular Patching**: Apply software and firmware updates to fix known vulnerabilities. - **Vulnerability Scanning**: Continuously identify and address weaknesses in systems. - **Intrusion Detection Systems (IDS)**: Monitor systems for signs of exploit attempts. - **Endpoint Protection**: Deploy antivirus and endpoint detection tools to block exploits. - **User Awareness**: Educate users about [phishing](/content/glossary/phishing/index.html) and other social engineering attacks often used to deliver exploits. --- ## Exploit FAQs ### What is the difference between a vulnerability and an exploit? A **vulnerability** is a weakness in a system, while an **exploit** is the tool or method used to take advantage of that weakness. ### What is a zero-day exploit? A zero-day exploit targets a previously unknown [vulnerability](/content/glossary/vulnerability/index.html), leaving organizations with "zero days" to patch or protect against it. ### How do attackers deliver exploits? Exploits can be delivered through [phishing](/content/glossary/phishing/index.html) emails, malicious websites, exploit kits, or compromised software downloads. ### How can I protect my systems from exploits? Protect systems by regularly updating software, using security tools like IDS and endpoint protection, and educating users to recognize potential threats. ## About Corbado Corbado is the **Passkey Intelligence Platform** for large-scale CIAM teams running consumer authentication. We help you see what IDP logs and generic analytics tools can't: where passkeys, passwords, OTP, social login and fallback journeys succeed, stall or fail, which devices and browsers create friction, and when an OS update silently breaks login. Two products: **Corbado Observe** layers **process mining and observability across authentication journeys.** **Corbado Connect** adds **managed passkeys with analytics built in** alongside your IDP. VicRoads runs passkeys for 5M+ users with Corbado (more than 80% passkey activation rate). [Talk to a Passkey Expert →](/content/contact/index.html) See what's really happening in your passkey rollout. [Book a Demo](/content/contact/index.html) --- ## Related Terms - [**Brute Force Attack**](/content/glossary/brute-force-attack/index.html) - [**Credential Stuffing**](/content/glossary/credential-stuffing/index.html) - [**Cyber Attack**](/content/glossary/cyber-attack/index.html) - [**Data Breach**](/content/glossary/data-breach/index.html)