Cybersecurity Foundations (Grades 9–12) · lesson 4 of 7 · 12 min
Risk, vulnerability, and threat — what is the difference? These three terms are often confused but have precise meanings in security: Vulnerability: a weakness in a system — a bug, misconfiguration, or design flaw. A vulnerability exists whether or not anyone exploits it. Threat: anything that could exploit a vulnerability — an attacker, a natural disaster, a careless employee. A threat is a potential cause of harm. Risk: the likelihood and impact of a threat exploiting a vulnerability. Risk = Threat × Vulnerability × Impact. Example: An unpatched web server (vulnerability) exposed to the internet (threat) that stores customer credit cards (high impact) = high risk. The same unpatched server on an air-gapped internal network with no sensitive data = low risk. Risk treatment options Mitigate: apply a control to reduce likelihood or impact (patch the server). Accept: acknowledge the risk and do nothing (acceptable for very low-risk items). Transfer: shift the risk to a third party (cyber insurance). Avoid: eliminate the activity that creates the risk (shut down the vulnerable service).
Match the term
Try it: Risk, vulnerability or threat?
Previous lesson: Threat modeling basics
Back to Cybersecurity Foundations (Grades 9–12)
Next lesson: Authentication factors