Exploit intelligence has its own vocabulary, and terms like exploitable, exploited and exploit available are often confused. This glossary defines the main ones in plain words, using definitions from CISA and FIRST where they exist, so your team and your reports use each word the same way.
The terms
| Term | Plain definition |
|---|---|
| CVE | A unique, common identifier for a publicly known security flaw, assigned by a CVE Numbering Authority |
| Exploitable | How easily an attacker can take advantage of a flaw, considering a public proof of concept, network access, privileges, wormability and skill needed (CISA's description) |
| Wormability | An attack that can spread from one machine to another without user interaction |
| Proof of concept (PoC) | Code for a flaw that, when run, would allow exploitation; shared between researchers and vendors, and sometimes made public |
| Exploit framework module | A packaged exploit for an open source framework, a more operational form than a raw PoC |
| Scanner template | A definition of a check for a scanning engine, which can test many targets quickly |
| Exploited, or active exploitation | Reliable evidence that malicious code was executed against a system without the owner's permission; includes attempts and successes |
| Attempted exploitation | An attacker runs code against a target but it does not succeed, for example because the system is not vulnerable or is a honeypot |
| Successful exploitation | The attacker succeeds and takes unauthorized actions on the system or network |
| In the wild | Happening in real time against real targets, not in a lab |
| Honeypot | A decoy system set to detect or counteract attempts at unauthorized use |
| KEV | CISA's Known Exploited Vulnerabilities catalog, a curated list with reliable exploitation evidence and a remediation action |
| EPSS | A model from FIRST that estimates the probability of observed exploitation activity in the next 30 days |
| EPSS percentile | The proportion of scored vulnerabilities with the same score or lower |
| Base rate | The share of vulnerabilities that see exploitation in a period; FIRST gives roughly 2 to 3 percent for 30 days |
Three pairs people mix up
Exploitable versus exploited. Exploitable is about ease. Exploited is about events. CISA says exploitability is not a criterion for KEV, which asks whether exploitation actually happened.
PoC versus attack. CISA says a public PoC does not automatically mean a flaw has been or will be exploited. It can raise the likelihood.
Scanning versus exploitation. CISA lists scanning as not active exploitation. Running exploit code at a target is.
Two more that matter
Probability versus percentile. The probability is the absolute estimate. The percentile is a ranking. Because most scores are tiny, a 10 percent probability sits near the 95th percentile, per FIRST's FAQ.
Forecast versus record. KEV is a record of past confirmed exploitation. EPSS is a forecast. A low forecast on a listed item is not a contradiction.
Using the glossary
- Paste it into your vulnerability policy as an appendix.
- Require reports to use these words, so a ticket that says exploited means the KEV or vendor meaning, not a PoC.
- Review it each year. CISA and FIRST may update their pages.
A shared vocabulary reduces arguments. When someone says "it is exploitable", ask: do you mean easy to exploit, or known to be exploited? The answer changes the response.
Safeguard's reachability analysis, SBOM and dependency scanning and policy gates help turn these definitions into checks on your own code. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
As you click, notice which of the terms above each piece of evidence would map to.
Quick check
Is exploitable the same as exploited?
No. Exploitable is about how easy an attack is. Exploited means there is reliable evidence it was used. CISA keeps them apart in its KEV criteria.
Does a honeypot hit count as exploitation?
For KEV, CISA treats it as attempted exploitation, which counts as active exploitation. It is not a successful compromise of a real target.
Sources
Last reviewed: 19 October 2026.
