What is the difference between a threat, vulnerability, and risk?

During security assessments, teams must clearly distinguish between threats, vulnerabilities, and risks to prioritize remediation.

Define each term and explain how they relate in a security context.

A threat is any potential danger that could exploit a weakness (hackers, malware, natural disasters). A vulnerability is a weakness in a system (unpatched software, misconfiguration, weak passwords). Risk is the likelihood and impact of a threat exploiting a vulnerability. Risk = Threat x Vulnerability x Impact. This relationship drives risk-based security decision making.

Understanding this distinction allows proper risk assessments, prioritized patching based on risk scores, and effective communication with management about security posture.