What is the difference between threats, vulnerabilities, and risks?

These are fundamental security concepts often confused but with distinct meanings:

Threat: A potential danger or adverse event that could harm a system

• External entity or circumstance that could cause harm
• Examples: Hackers, malware, natural disasters, insider threats

Vulnerability: A weakness or flaw in a system that could be exploited

• Security gaps in design, implementation, or configuration
• Examples: Unpatched software, weak passwords, missing access controls

Risk: The likelihood and impact of a threat exploiting a vulnerability

• Risk = Threat × Vulnerability × Impact
• Measurable in business terms (financial, reputation, operational)

Relationship Example:

• Threat: Malicious hacker (external threat actor)
• Vulnerability: Unpatched web server with known SQL injection flaw
• Risk: 70% probability of data breach within 6 months, estimated $2M impact

Risk Management: You can't eliminate threats, but you can reduce vulnerabilities and mitigate risks through security controls.