What it means
These terms describe different parts of a security problem. A weakness may exist without an active threat, and a threat may be irrelevant when it cannot reach the asset. Risk decisions require context, likelihood, impact, and existing safeguards.
Why it matters
Using the terms accurately improves assessments, incident discussions, control selection, and communication with nontechnical decision-makers.
Practical focus
- Describe the asset and business objective first
- Separate the weakness from the actor or event
- Consider existing controls and exposure pathways
- State impact in operational or business terms
Common mistakes
- Using risk as a synonym for vulnerability
- Scoring technical severity without business context
- Assuming every theoretical threat deserves equal attention
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: