Exploit
Code or a technique that takes advantage of a vulnerability to gain unauthorized access or execute actions. Especially dangerous when combined with unpatched, unmanaged IoT or OT devices.
What is Exploit?
Code or a technique that takes advantage of a vulnerability to gain unauthorized access or execute actions. Especially dangerous when combined with unpatched, unmanaged IoT or OT devices.
An exploit is code, a sequence of commands, or a technique that takes advantage of a vulnerability to cause unintended behavior — typically gaining unauthorized access, executing arbitrary code, escalating privileges, or causing a denial of service. Exploits are the operational mechanism through which vulnerabilities become actual threats: the vulnerability is the weakness; the exploit is the attack that weaponizes it.
Exploits exist on a spectrum of accessibility. Zero-day exploits — targeting vulnerabilities unknown to the vendor — are typically developed by well-resourced nation-state actors or sophisticated criminal organizations and are used carefully to preserve their value. Public exploits — where working exploit code is published in tools like Metasploit or on exploit databases — are available to any attacker and dramatically lower the bar for exploitation. The presence of a public exploit is the clearest signal that a vulnerability requires urgent remediation.
In IoT and OT environments, exploit risk has unique characteristics. Many OT protocols (Modbus, BACnet, DNP3) have no authentication — a "vulnerability" that is exploited simply by sending properly formatted commands. These environments don't need sophisticated exploits because the protocols themselves allow unauthenticated command execution. The exploit is sometimes as simple as knowing the protocol specification.
Key Facts
- Less than 5% of published CVEs have publicly available exploit code — but these CVEs account for the majority of breaches
- Metasploit contains over 2,000 exploit modules targeting enterprise systems, including OT-specific exploits
- The time from CVE publication to public exploit availability has dropped from months to days for high-profile vulnerabilities
- Most OT protocol exploits require no sophisticated code — unauthenticated command access is built into legacy protocol design
How ORDR Addresses Exploit
ORDR correlates CVE data with known exploit availability — including Metasploit modules and ExploitDB entries — to elevate the risk score of assets where working exploits exist. Combined with KEV status and EPSS probability, exploit availability is one of the strongest prioritization signals ORDR uses to surface the vulnerabilities most urgently requiring remediation or compensating controls.
See ORDR in actionFrequently Asked Questions
Complete visibility across your entire attack surface.
ORDR unifies IT, IoT, and OT asset intelligence so your team can see—and act on—what matters most.