Security Fundamentals: Vulnerability, Threat, and Risk
Understanding the relationship between these three concepts is essential for prioritizing security efforts and communicating with stakeholders.
Definitions
Technical vs. Business Perspective
While technical definitions are important, advanced practitioners translate these into business impact.
Vulnerability
A vulnerability is a technical flaw, weakness, or gap in security procedures, internal controls, or implementation that could be exploited.
- Technical: A buffer overflow in a web server.
- Process: Lack of multi-factor authentication (MFA) on external accounts.
Threat
A threat is the actual adversary or actor that has the potential to harm a system or organization. It is the “who” or “what” that exploits the vulnerability.
- Examples: Ransomware groups, state-sponsored actors, malicious insiders, or automated bots.
Risk
Risk is the intersection of vulnerability and threat. It represents the potential for loss or damage when a threat exploits a vulnerability.
- Business Impact: Advanced security professionals define risk as the actual cost to the business (financial, reputational, or legal) if an attacker succeeds.
Summary Relationship
- Without a vulnerability, there is no path for a threat.
- Without a threat, a vulnerability poses no immediate danger.
- Without impact, the technical occurrence may not translate to a business risk.