How could he wage war against an unseen invader that had no known vulnerability?

They're more in the older days where devices, for example, might have a known vulnerability.

But given that you're using the best wireless encryption available, the only known vulnerability is just guessing the password.

But that's the only known vulnerability in the protocol.

So what would software have to do in order to exploit this known vulnerability?

But there is a bad known vulnerability in Java which virtually the whole industry has fixed except Apple.

And known vulnerabilities remaining unpatched for, like, six, nine months even.

Turns out that Plesk had a known vulnerability that was fixed months ago.

Always the word "known" is there, no known vulnerabilities.

Still, it's wiser to let them use a known vulnerability and prepare.