Proof of concept
Also known as PoC
A demonstration that a vulnerability is genuinely exploitable, rather than theoretically present.
In a report, the proof of concept is what makes a finding actionable and hard to dismiss: the exact request, the screenshot, the data retrieved. It removes the argument about whether the issue is real.
Publicly available proof-of-concept code also changes patching urgency dramatically, since it collapses the skill required to exploit an issue.
Where this comes up
Proof of concept sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
Exploitation Using a discovered weakness to gain access or execute code on a target. Exploit Code or a technique that takes advantage of a vulnerability to make a system do something unintended. False positive A reported finding that turns out not to be a genuine issue in your environment. Remediation Fixing the issues a test identified, in priority order.