[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Attack Surface Management](/category/attack-surface-management) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is The Difference Between Vulnerabilities and Misconfigurations?](/blog/vulnerabilities-vs-misconfigurations) Publish date November 19, 2024 {x} minute read # What is The Difference Between Vulnerabilities and Misconfigurations? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) [Vulnerability](/blog/vulnerability) assessment is a necessary component of any complete security [toolchain](/blog/testing-avoid-configuration-security-issues), and the most obvious place to start for anyone looking to improve their security. Ironically, starting with [vulnerability assessment](/blog/vulnerability-assessment) can actually degrade an organization's overall defense by shifting focus from the cause of most outages and [breaches](/breaches): misconfigurations. ## Misconfigurations - Not Very Cool, But Extremely Important Sophisticated, high-profile [cyber attacks](https://www.upguard.com/blog/cyber-attack) get the most attention, in part because they are terrifying and in part, let's admit it, because they are cool. Transmitting a binary across air-gapped systems using fluctuations in temperature caused by CPU usage is cool. Logging into a system where the username and password haven't been changed from the defaults, or are on a post-it note hanging hanging from the monitor, are not cool. One of these [attack vectors](https://www.upguard.com/blog/attack-vector) is far more likely to happen to you than the other. Given limited resources, you would do better to invest in the far more likely risk. To put it in everyday terms, skipping configuration integrity to jump straight to vulnerability detection is like taking classes on how to wrestle alligators and driving there with your seatbelt unbuckled. While you might fare much better in an encounter with an alligator, you've increased your overall risk of mortality by missing the fundamentals. [Learn about the top security misconfigurations causing data breaches >](https://www.upguard.com/blog/security-misconfigurations-causing-data-breaches) ## Integrity, Availability, and Confidentiality - Not Just for Campaign Slogans > *"Putting the fundamentals of *[*information security*](/blog/information-security)* front and center provides the means to prioritize competing initiatives and make misconfigurations a top concern."* The significance of configuration integrity and vulnerability assessment should both be measured by their ability to increase information security. The three components of information security are [data integrity, availability and confidentiality](/blog/cia-triad). A loss of data integrity means it has been corrupted; availability means it can no longer be delivered to the appropriate user; and confidentiality means that it has been made available to an incorrect user. Putting the fundamentals of information security front and center provides the means to prioritize competing initiatives and make misconfigurations a top concern. ## Making a List and Checking it Twice What does vulnerability assessment catch? [A software vulnerability](https://www.upguard.com/blog/how-to-identify-vulnerable-third-party-software) means that a particular crafted input to a program can result in a loss of information security, from low severity denial of service attacks to business-rattling [data leaks](https://www.upguard.com/blog/data-leak). Vulnerability assessment is one way to improve information security by comparing the software you have to a list of software that is known to have vulnerabilities. (Getting the list and executing the comparison is complex, but at least the idea is straightforward.) The list of vulnerable software grows over time as security researchers experiment with new ways to make programs do something they're not supposed to. Once a program is known to have a vulnerability then the provider issues a patch, users update, and they are no longer subject to that vulnerability. At least in theory. [Read our full post on vulnerability assessment >](/blog/vulnerability-assessment) ## Reality Check, Please Basic patching is a critical activity for infosec, but one that is easier said than done. Patches for [zero day vulnerabilities](/blog/zero-day) are rushed out to mitigate an urgent risk and may introduce operational problems-- ie, a loss of availability-- due to a limited testing window, limited development resources for open source software, and the permutational complexity of the systems themselves. They also may require additional subsequent patches to address more sophisticated methods of exploiting the same underlying problem. (And some problems may be so fundamental that there is no easy and foolproof solution.) [Vulnerability assessment](https://www.upguard.com/blog/cve-2021-26855) is, to borrow Gartner's phrase, bimodal. On one hand, organizations want to keep up with whatever the latest [exploit](/blog/exploit) is that they're seeing on zdnet. On the other, they are more than likely already way behind on the ever growing list of known vulnerabilities. [99% of vulnerability exploits in 2014 had patches more than a year old](https://web.archive.org/web/20170612073134/http://www.verizonenterprise.com/resources/reports/rp_data-breach-investigation-report_2015_en_xg.pdf). That is to say, you would be 99x better off ignoring whatever is on the front page of the internet and instead fixing something that's been broken for over a year. ## Beyond the Seat Belt - Fixing the Car > *"Through 2020, 80% of cloud breaches will be due to customer misconfiguration, mismanaged credentials or insider theft, not cloud provider vulnerabilities."\ > \ > -Gartner* Patches might address vulnerabilities but they also might just address bugs, providing further evidence that good information security practices are on a continuum from out maneuvering clever attackers to avoiding dumb mistakes. If we continue down the continuum past basic patching then we get to misconfigurations. Just as patching has a bigger impact on security than cutting edge vulnerability detection, configuration integrity again has a larger effect on your ability to maintain information security. Numerous studies have found that misconfigurations are responsible for the majority of breaches and outages. According to Gartner, [99% of all firewall breaches will be caused by misconfigurations](https://www.infosecurity-magazine.com/opinions/to-err-is-human-to-automate-divine/), not vulnerabilities. Gartner's previous analysis adds that misconfigurations account for some [70% of mobile breaches](https://www.gartner.com/en/newsroom/press-releases/2014-05-29-gartner-says-75-percent-of-mobile-security-breaches-will-be-the-result-of-mobile-application-misconfiguration) and [cloud misconfigurations](https://www.upguard.com/blog/cloud-misconfiguration) account for [80% of cloud breaches](https://web.archive.org/web/20180111054231/http://www.datacenterjournal.com/top-cloud-security-trends-for-2016/) as well. At some point it seems like an abuse of language to blame vulnerabilities when the software itself is badly out of date or even past end of life. Vulnerability assessment is a valid concern, but one that must come after repeatable, auditable processes for remediating [misconfigurations](/blog/biggest-threat-to-atm-security-is-misconfiguration). Not only are misconfigurations more likely to lead to business disruption due to a lapse of information security, it is unlikely you will be able effectively remediate the vulnerabilities themselves without the processes. For the sake of clarity, it is worthwhile to continue to use "vulnerability assessment" to mean the comparison of actual software versions to those on a blacklist. For pragmatic operations and security professionals wondering "am I vulnerable to a loss of integrity, availability, or confidentiality," misconfigurations should be the first things they check. Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)