People often mix up the words vulnerability, threat, and risk. Understanding the difference is one of the most useful things in this whole course.
What is it?
- Vulnerability — a weakness that could be exploited (an unlocked window).
- Threat — something that could take advantage of the weakness (a burglar).
- Risk — the chance that the threat meets the vulnerability, and how bad it would be (the likelihood you get burgled, and what you would lose).
Select any component in the diagram to read what it does.
Text description of this diagram
A vulnerability is a weakness; a threat is who or what could use it; risk is the chance and impact of it happening.
Why is it important?
These three words let you describe danger precisely. Security work is really about managing risk: you reduce it by fixing vulnerabilities, blocking threats, or lowering the impact if something goes wrong.
How does it work?
A simple way to remember it: Risk = Threat × Vulnerability × Impact. If any one of them is near zero, the risk is low. Remove the weakness, and even a determined threat has nothing to exploit.
Three ways to reduce risk
- Fix the vulnerability — e.g. install a software update that closes the weakness.
- Reduce the threat — e.g. block a malicious sender.
- Lower the impact — e.g. keep backups so losing data hurts less.
A real-world example
An office computer runs outdated software with a known weakness (vulnerability). Criminals are scanning the internet for that exact weakness (threat). The computer stores the only copy of the payroll (high impact). Together that is a serious risk. Installing the update removes the vulnerability — and the risk drops sharply.
Check what you learned
Give the house analogy for vulnerability, threat, and risk.
Vulnerability = an unlocked window; threat = a burglar; risk = the chance of being burgled and how much you would lose.
Name one way to reduce risk without stopping the threat itself.
Fix the vulnerability (e.g. apply an update) or lower the impact (e.g. keep backups).
Key takeaways
- A vulnerability is a weakness; a threat is what could exploit it; risk is the chance and impact of the two meeting.
- Security is the practice of managing risk.
- You can reduce risk by fixing weaknesses, blocking threats, or lowering impact.