Typically, vulnerabilities are exploited repeatedly by attackers to attack weaknesses that organizations have not patched or corrected. A report in a SANS Security Alert, dated May 2000, provides a discussion of this issue: “A small number of flaws in software programs are responsible for the vast majority of successful Internet attacks . A few software vulnerabilities account for the majority of successful attacks because attackers don't like to do extra work. They exploit the best-known flaws with the most effective and widely available attack tools. And they count on organizations not fixing the problems.” .
