Security Concepts · Topic 4 of 8
Risk, Threat, Vulnerability and Exploit
Compare risk, threat, vulnerability and exploit, and learn how risk is assessed, scored, weighted, reduced or accepted in a security programme.
- 4 min
- A threat is something that could cause harm.
- A vulnerability is a weakness.
- An exploit is the method or code that uses a vulnerability.
What it is
Risk, threat, vulnerability and exploit are four related words with four different meanings.
Security teams use them precisely. A question will often describe a situation and ask you to name the right term.
The four fit together in a chain. A threat uses an exploit against a vulnerability, and the result is a risk to an asset.
How it works
Each term describes one link in the chain, and risk management weighs the whole chain.
The four terms
| Term | Meaning | Example |
|---|---|---|
| Threat | Anything that could cause harm to an asset | A criminal group, malware, a flood |
| Vulnerability | A weakness that a threat could use | An unpatched server, a weak password |
| Exploit | A method or code that takes advantage of a vulnerability | A script that abuses a software flaw |
| Risk | The chance that a threat uses a vulnerability, combined with the impact | Likely data loss from the unpatched server |
A vulnerability alone does no harm until something uses it. A threat with nothing to exploit also does little. Risk appears when both exist and the asset matters.
An asset is anything of value, such as data, a server or a reputation.
Risk assessment
A risk assessment is the process of finding assets, threats and vulnerabilities, and working out how much risk each combination creates. It answers three questions. What could go wrong, how likely is it, and how bad would it be?
Risk scoring and weighting
Risk is usually estimated from likelihood and impact. A simple model multiplies the two.
| Low impact | High impact | |
|---|---|---|
| High likelihood | Medium risk | High risk |
| Low likelihood | Low risk | Medium risk |
Risk scoring gives each risk a number or a rating, so risks can be ranked. Risk weighting adjusts the score using what matters to the organisation. A flaw on a server holding customer data is weighted higher than the same flaw on a test machine.
Ranking lets a team fix the highest risks first, since it cannot fix everything at once.
Risk reduction
Once risks are ranked, the organisation chooses how to treat each one. Common choices are:
- Reduce the risk by adding controls, such as patching or segmentation
- Accept the risk when it is small or the control costs more than the loss
- Transfer the risk, for example with insurance or by using a provider
- Avoid the risk by stopping the risky activity
Risk reduction means lowering likelihood, impact or both. Patching lowers likelihood. Backups lower impact.
Some risk always remains after controls are applied. This is called residual risk.
Telling the terms apart
Questions often give a scenario, so test each term against it.
- An unpatched web server is a vulnerability.
- A script that abuses that flaw is an exploit.
- The attacker or malware that runs the script is the threat.
- The likely loss of customer data is the risk.
What to remember for the exam
Seven facts cover most questions on this topic.
- A threat is something that could cause harm.
- A vulnerability is a weakness.
- An exploit is the method or code that uses a vulnerability.
- Risk combines the likelihood of harm with its impact.
- A risk assessment finds and evaluates risks so they can be ranked.
- Risk weighting adjusts a score using the value of the asset to the organisation.
- Risk can be reduced, accepted, transferred or avoided, and residual risk remains.
Think of a chain. The threat uses an exploit against a vulnerability, and the outcome is risk.
Common mistakes
These four errors appear often.
Using vulnerability and threat as synonyms. A vulnerability is a weakness in the target. A threat is the source of possible harm.
Treating risk as the same as a vulnerability. A weakness on an unimportant, isolated system may carry little risk.
Thinking controls remove all risk. Residual risk stays after treatment.
Calling an exploit the attacker. The exploit is the technique or code, and the attacker is the threat actor.
Accepting a risk is a valid, documented decision, not a failure to act.
Check yourself
Work through these three questions.
How does an exploit differ from a vulnerability?
A vulnerability is a weakness. An exploit is the method or code that takes advantage of that weakness.
What two factors usually combine to estimate risk?
Likelihood and impact. Together they show how likely harm is and how bad it would be.
What is residual risk?
It is the risk that remains after controls have been applied.
Topic 4 of 8 in Security Concepts
Test yourself on Security Concepts
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.