It is the means of exercising a weakness, not the weakness itself. An exploit may be a controlled proof of concept, an assessment tool, or part of malicious activity.
Successful exploitation depends on context. Version, configuration, reachability, privileges, user interaction, mitigations, and reliability affect the result. An exploit may demonstrate a crash, information disclosure, authentication bypass, code execution, or another consequence; it does not always install malware or provide continuing access.
Key points
FormsExploits can be software, crafted input, protocol exchanges, malicious documents, or multi-step actions. One exploit may combine weaknesses.
EvidenceTreat public code, demonstrations, scanner output, threat reporting, and observed exploitation as different evidence types. Record provenance, affected conditions, and what outcome was actually verified.
Defensive useAuthorized testers may use controlled exploits to validate exposure and impact under rules of engagement. Production testing requires explicit ownership, safety controls, stop conditions, and evidence handling.
Important limitationThe existence of exploit code does not establish that every nominally affected system is reachable or exploitable. Absence of public exploit code does not establish safety, and unsuccessful attempts do not prove that the weakness is harmless.