Threat, Vulnerability, and Risk Explained: Why the Difference Matters in Cybersecurity

Many cybersecurity articles use the terms threat, vulnerability, and risk interchangeably, but they describe three distinct concepts. A threat is any external force that could cause harm, a vulnerability is a weakness that could be exploited, and risk is the product of both combined with potential impact. The widely used formula in the field expresses this as: Risk = Threat × Vulnerability × Impact. Security professionals focus on reducing risk by targeting the factors within their control, such as patching systems or strengthening passwords, rather than eliminating every known vulnerability. This prioritisation process, known as risk management, forms the core of most cybersecurity roles in practice.