Tools / Cyber Security Interview Questions
What is the difference between a Vulnerability, a Threat, and a Risk?
| Term | Meaning |
| Vulnerability | A weakness in a system that could be exploited, e.g. an unpatched server |
| Threat | Anything with the potential to exploit that weakness, e.g. an attacker or malware |
| Risk | The likelihood and impact of a threat actually exploiting a vulnerability |
A simple way to connect them: risk exists where a threat meets a vulnerability. An unpatched server sitting on an isolated network with no internet access has much lower risk than the same unpatched server exposed directly to the internet, even though the vulnerability itself is identical, because the exposure to threats is different.
What is a 'threat' in this model?
Where does 'risk' exist according to this model?
More Related questions...
