Security & GRC · Visual Explainer
Vulnerability vs Threat vs Risk
The concept
A vulnerability is the open window — the weakness. A threat is the burglar — anything that could exploit it. Risk is the combination: how likely the burglar finds that window, and what you lose if he climbs through. Risk = threat × vulnerability × impact.
Key distinctions
| Term | What it means |
|---|---|
| Vulnerability | A flaw that could be exploited — unpatched CVE, weak password, open port. Found by scanners and audits. |
| Threat | Anything that could exploit it — ransomware crews, phishing, insider misuse. You mostly can't reduce threats, only know them. |
| Risk | Likelihood × impact — the business quantity you actually prioritize on. Same vulnerability, different risk depending on exposure. |
| The formula's power | Remove any one factor and the risk collapses. Patch, segment, or encrypt — defense in depth attacks multiple factors at once. |
Why it matters in practice
200 scan findings and time to fix 20 means prioritizing by risk, not raw severity. A medium flaw on the payment path outranks a critical on an isolated test box.