Risk vs Threat vs Vulnerability

Try it out loud first. Then check yourself:

1. Threat: an actor or event that could cause harm (ransomware crew, insider, flood). You rarely control it.
2. Vulnerability: a weakness a threat can exploit, e.g. unpatched VPN appliance, missing MFA, weak process.
3. Risk: likelihood a threat exploits a vulnerability x business impact. Asset value is what makes it matter.
4. Example: ransomware gang (threat) + unpatched Citrix (vuln) on a payroll server (asset) = outage/extortion risk.
5. Treatment options: mitigate, transfer (insurance/contract), avoid (retire system), or formally accept.

If the interviewer pushes back

• If you cannot change the threat, which levers actually move the risk score, and how do you prove it moved?
• How does residual risk differ from inherent risk, and who should sign off on accepting it?

Go deeper

• csrc.nist.gov/pubs/sp/800/30/r1/final