Threats, vulnerabilities, risks and exploits: the words that matter

Read a security headline and you will meet the same four words again and again: threat, vulnerability, risk and exploit. They are often used as if they meant the same thing. They do not, and mixing them up leads to bad decisions, such as panicking about a flaw that cannot touch you, or ignoring one that can. Here is what each means, and how they fit together.

Threat: something that could cause harm

NIST describes a threat as any circumstance or event with the potential to adversely affect an organisation’s operations, assets or people through unauthorised access, destruction, disclosure or modification of information, or denial of service. A threat can be a person (a criminal group, a careless employee), an event (a flood, a power cut) or a piece of software. A threat on its own does nothing to you; it needs a way in.

Vulnerability: a weakness that could be used

A vulnerability is a weakness in a system, its security procedures, its internal controls or its implementation that a threat could exploit. It can be a bug in software, a default password nobody changed, a misconfigured sharing setting, or a process such as “we approve bank changes by email”. Publicly known software vulnerabilities get an identifier from the CVE programme (for example CVE-2024-12345, a format meaning year and number), so that everyone can talk about the same flaw. They are often given a severity score using the Common Vulnerability Scoring System (CVSS), from 0 to 10.

Exploit: the method that turns a weakness into an attack

An exploit is the technique, or the piece of code, that takes advantage of a vulnerability. The vulnerability is the unlocked window; the exploit is climbing through it. Many vulnerabilities are never exploited in practice, because they are hard to reach or unrewarding. Others are exploited widely within days of being published. That is why CISA keeps a catalogue of Known Exploited Vulnerabilities: flaws that attackers are confirmed to be using in real attacks, which deserve priority over everything else.

Risk: how likely, and how bad

Risk combines everything. In NIST’s terms it is a measure of how much you are threatened by a potential event, typically a function of the harm it would cause if it happened and the likelihood that it happens. A simple way to hold it in your head:

Risk = likelihood that a threat uses a vulnerability × impact if it succeeds.

If there is no threat interested in you, no vulnerability, or no impact, the risk is low. A critical vulnerability in software you do not use is no risk to you. A modest vulnerability in the one app that holds your bank login may be a big one.

One example, all four words

What you can control

You rarely control the threat: criminals will exist whatever you do. You often control the vulnerability, by installing updates, removing software you do not use and fixing weak settings. And you can reduce the impact, with backups, encryption and by limiting what each app can reach. Reducing any one factor reduces the risk. This is also why defence in depth works: even if an exploit succeeds on one layer, another layer, such as a firewall that stops an unknown program from sending data out, can keep the impact small.

Reading headlines with the four words

Next time you read “critical vulnerability found in…”, ask three questions. Do I use the affected product and version? Is it being exploited in the wild, or only theoretical so far? What would it give an attacker on my machine? The answers turn an alarming headline into a clear action, which is usually simply: update.