ISC Risk · Updated November 2026
Threat, Vulnerability, Risk, Exploit: Which One Is the Weakness?
These terms describe different parts of the same security problem.
Vulnerability
A weakness such as unpatched software, weak password policy, or misconfiguration.
Threat
Something capable of causing harm, such as an attacker, malware, insider, or natural disaster.
Exploit
A technique or method used to take advantage of a vulnerability.
Risk
Risk reflects the possibility that a threat exploits a vulnerability and creates harmful impact. Controls reduce likelihood, impact, or both.
The takeaway
Vulnerability is the weakness. Threat is the danger. Exploit is the method. Risk is the resulting exposure.
Related Summit guides
FAQ
Is an unpatched server a threat?
It is primarily a vulnerability.
Is ransomware a threat?
Yes.
Can controls reduce risk without eliminating the vulnerability?
Yes.