What is the difference between risk, threat, and vulnerability?

• A. Vulnerability is a weakness; threat is a potential attacker or exploitation method; risk is the likelihood and impact of a threat exploiting a vulnerability.
• B. Risk is a weakness; threat is the impact; vulnerability is the attacker.
• C. Threat is a system; vulnerability is a component.
• D. Vulnerability is an initiative to reduce risk.

Answer: (A)

Understanding how these three concepts relate helps you prioritize security work. A vulnerability is a weakness or flaw in a system, process, or control that could be exploited—like unpatched software, weak configurations, or poor access controls. A threat is something that could take advantage of that weakness, such as an attacker, malware, or even a natural disaster; it represents the potential source of harm, not the actual harm itself. Risk is the likelihood that harm will occur if a threat exploits a vulnerability, multiplied by the impact if it happens. In other words, risk combines both the chance of exploitation and the consequences.

This matches the idea that risk is the likelihood and impact of a threat exploiting a vulnerability. For example, an unpatched server (vulnerability) that is facing active online attackers (threat) with sensitive data at stake creates high risk, whereas the same vulnerability with no active threat would present a lower risk. The other choices mix up the concepts—risk isn’t a weakness, threats aren’t the impact, and vulnerabilities aren’t attackers or initiatives to reduce risk.