Threats, vulnerabilities, and risk

Three words people mix up

In everyday talk, "threat", "vulnerability", and "risk" get used as if they mean the same thing. In security they do not, and keeping them apart makes it much easier to decide what to fix first.

Here is the short version. A vulnerability is a weakness. A threat is something that could take advantage of that weakness. Risk is the chance that it actually happens, and how much it would hurt if it did.

A vulnerability is a weakness

A vulnerability is a gap that could be taken advantage of. It is not an attack, and it is not the attacker. It is simply the open window.

Everyday examples:

• software that has not been updated to fix a known bug
• a password reused across several sites
• a door that is propped open for convenience

None of these has caused harm on its own. Each one is a weakness waiting for something to find it.

A threat is what could exploit it

A threat is anything that could take advantage of a weakness and cause harm. Where a vulnerability is passive, a threat is the active side: a wave of scam emails aimed at staff, malicious software, or a person who walks in behind you through a secure door.

A threat with no matching weakness usually goes nowhere. A weakness with no threat may sit quietly for years. Trouble starts when the two line up.

Risk is the two together

Risk is the chance of loss, judged by how likely it is and how bad the impact would be. This is where a weakness and a threat meet a simple question: how much should we care?

Security teams answer it with one small formula:

Priority = Impact × Likelihood

Impact is how serious it would be if it happened. Likelihood is how probable it is. Multiplying the two gives a priority you can compare across very different problems, so the most serious and most likely ones rise to the top.

A worked example

A finance officer receives an email that looks like it is from a regular supplier, asking to change the bank account for the next payment. This is business email compromise (BEC), a common form of phishing.

• Vulnerability: there is no step that confirms a change of bank details.
• Threat: a scam email requesting exactly that change.
• Risk: high, because such emails are common (likely) and a wrong payment is expensive (high impact).

The fix follows the weakness. Add a step that verifies any change of payment details through a separate, trusted channel, for example a phone call to a number you already have on file. That one habit turns a high risk into a low one.

Check yourself