# A Comprehensive Review and Assessment of Cybersecurity Vulnerability Detection Methodologies
## 3 Motivation, Background, and VDB Assessment
### Terminologies and Theoretical Foundations
#### 3.2.1 Cyber Fundamentals  
The following cyber terminologies are extracted from guidelines and standards. The foundation of cybersecurity is based on the cyber items listed below and helps readers comprehend the remainder of this paper. Threat: It is a potential source of harm to a system or organization, impacting assets like information, processes, and systems. Threats can be natural or human-made, accidental or intentional. It is important to note that a threat agent can be an individual or a group that plays a crucial role in carrying out or assisting an attack [13]. Vulnerability: Refers to a flaw in an asset or security measure that can be exploited by one or more threats. Vulnerability assessment (VA) is a continuous activity that involves monitoring and identifying these flaws. It must be carried out by cyber experts using a reliable and resilient system [14]. Risk: In general, risk refers to events, consequences, or both, and specifically, when a threat exploits a vulnerability in an information asset or a collection of assets, causing harm to an organization [14]. In addition, the risk can be identified, analyzed, measured, based on impact and occurrence, and subsequently treated. Following numerous standards, such as ISO/IEC 27005 or the NIST Risk Management Framework (RMF) [15, 16], it is recommended that organizations apply a PDCA (Plan-Do-Check-Act) technique for continuous development [17]. PDCA: Plan: Identify and assess cyber threats, then strategically consider appropriate risk-reduction measures. Do: Implement these measures. Check: Conduct a performancereview, and Act: Monitor and enhance the risk treatment plan. In contrast, the NIST SP 800 30 aims to analyze risks using three major steps: S1--Risk assessments look at the risks across all organizational levels, S2--Focus on business processes, considering sales, marketing, or HR (Human Resources) procedures, and S3--Leverage the technological level by integrating applications, systems, and information flows [18]. Impact: Defines the magnitude of the harm that can be expected from unauthorized disclosure, alteration, or destruction of information, and loss of information or system availability [19]. These repercussions can affect confidentiality, integrity, availability, or all three. Security measures: They encompass any processes, policies, devices, practices, or other activities that may be administrative, technological, managerial, or legal in nature that are meant to change a risk state. Classified by their function, security measures can be preventive, detective, or corrective [20, 21]. Exploit: It refers to the frequency of attacks targeting assets, exploiting a specific vulnerability, and the likelihood of a vulnerable system being attacked [22]. Assets: It includes data, personnel, devices, systems, and facilities that enable the organization to achieve business objectives [20]. Assets may be divided into two groups: Physical assets include money, equipment, stocks, and items, as well as network and server infrastructure, etc. Virtual assets include accounts, data, business plans, and reputation, etc. CIA: Confidentiality (C) ensures information is not made available or disclosed to unauthorized individuals, entities, or processes (authentication, authorization, and access control). Integrity (I) protects the accuracy and completeness of assets (information changed). Availability (A) ensures that assets are accessible and usable on demand by an authorized entity [23]. Attack Vector (AV): Specific path or scenario used by a hacker or malicious actor to exploit vulnerabilities and gain access to a target system [24]. Access Complexity (AC): A metric capturing the actions an attacker must take to evade or bypass security measures to exploit a vulnerability [22, 25]. In summary, cyberspace integrates software, internet services, information technologies (IT), telecommunications networks, and technology infrastructures. This virtual environment links all previous cyber items directly or indirectly.