Vulnerability vs Threat vs Risk: What's the Difference?

Vulnerability, threat and risk are three of the most fundamental — and most frequently muddled — terms in cybersecurity. They're often used interchangeably, but they mean distinctly different things, and getting them straight is essential for making sound security decisions. In one sentence: a threat exploits a vulnerability to create risk.

Understanding how these concepts relate helps teams talk clearly about security, prioritize correctly, and avoid the common mistake of treating every weakness as an emergency.

What is a vulnerability?

A vulnerability is a weakness or flaw in a system, process or control that could be exploited to cause harm. It's a gap in your defenses — something on your side. Examples include:

• An unpatched software flaw (a CVE).
• A weak or reused password.
• A misconfigured cloud storage bucket left open to the internet.
• An employee who hasn't been trained to spot phishing.
• Missing multi-factor authentication.

A vulnerability on its own causes no harm — it's simply a door that could be opened. Whether it matters depends on whether a threat exists to exploit it and what's behind the door.

What is a threat?

A threat is anything with the potential to exploit a vulnerability and cause harm. Threats come from outside your control — they're the actors and events that could turn a weakness into an incident. Examples include:

• A threat actor such as a ransomware group or nation-state.
• A specific malware family or exploit.
• A natural event like a flood or power failure (threats aren't only malicious).
• A malicious or negligent insider.

You generally can't eliminate threats — you can't stop ransomware groups from existing. What you can control is your exposure to them by reducing vulnerabilities.

What is risk?

Risk is the potential for loss or damage when a threat exploits a vulnerability. It's the intersection of the two, weighted by likelihood and impact. Risk is what you actually manage, because it accounts for how likely harm is and how bad it would be.

A common way to express this is the conceptual formula:

Risk = Threat × Vulnerability × Impact

If any factor is near zero, the risk is low. A severe vulnerability with no threat targeting it, or on a system with no valuable assets behind it, carries little risk. Conversely, a moderate vulnerability that an active threat is exploiting on a critical system is high risk.

An example that ties it together

Imagine an internet-facing server running software with a known, unpatched flaw:

• The vulnerability is the unpatched flaw.
• The threat is the ransomware group actively scanning the internet for that exact flaw.
• The risk is the realistic possibility that the group exploits the flaw, encrypts the server and steals its data — combined with how damaging that loss would be to the business.

If the same flaw existed on an isolated system with no sensitive data and no internet exposure, the vulnerability would be identical, but the risk would be far lower — because the threat can't easily reach it and the impact is minimal. This is precisely why severity scores like CVSS aren't enough on their own; real prioritization requires assessing threat and impact too.

Why the distinction matters

Mixing these terms up leads to poor decisions. Teams that treat every vulnerability as an emergency burn out chasing flaws that pose little real risk, while genuine risks hide in plain sight. Effective security is risk-based: you reduce the vulnerabilities that matter most given the threats you actually face and the value of what you're protecting. Threat intelligence is the bridge — it tells you which threats are active and which vulnerabilities they're exploiting, turning an abstract list of weaknesses into a prioritized view of real risk.

Related terms: exposure, exploit and impact

Once the core trio of vulnerability, threat and risk is clear, a few related terms round out the picture and frequently come up in the same conversations:

• Exposure is a state of being susceptible to harm — for example, a system being reachable from the internet, which increases the likelihood that a threat can reach a vulnerability. Reducing exposure (through segmentation, firewalls or removing unnecessary services) lowers risk without necessarily fixing the underlying vulnerability.
• Exploit is the specific tool or technique a threat uses to take advantage of a vulnerability. The existence of a public exploit raises the likelihood component of risk, which is exactly why exploitation data is so important for prioritization.
• Impact is the magnitude of harm if a risk materializes — financial loss, operational disruption, reputational damage. Impact is what makes a risk worth caring about; a successful attack on a worthless asset carries little real risk.
• Likelihood is the probability that a threat will successfully exploit a vulnerability, shaped by exposure, exploit availability and the threat's capability and intent.

Putting it together, you can think of risk as a function of likelihood (how probable is a successful attack, given the threat, the vulnerability and the exposure) and impact (how bad would it be). This framing explains why effective security teams don't chase a flat list of vulnerabilities — they reduce risk by acting on whichever lever is most efficient. Sometimes that's patching the vulnerability; sometimes it's cutting exposure with a firewall rule; sometimes it's reducing impact by encrypting data or improving backups. Threat intelligence informs every part of this equation: it tells you which threats are active (the threat factor), which vulnerabilities are being exploited and have working exploits (likelihood), and which campaigns target assets like yours (helping you weigh impact). Speaking this language precisely — separating weakness from adversary from consequence — is what lets a team move from reacting to every finding toward managing real, prioritized risk.

The bottom line

A vulnerability is a weakness on your side; a threat is an external force that could exploit it; and risk is the potential harm when the two meet, weighted by likelihood and impact. You manage risk — not vulnerabilities in isolation — by reducing meaningful exposure to the threats you actually face. Knowing which threats are active is the missing ingredient, and our live threat intelligence feed provides it, tracking active campaigns and exploited vulnerabilities from dozens of authoritative sources, ranked by priority.