Key Concepts: Threat, Vulnerability, Risk and Impact

Confusing threat, vulnerability, risk and impact is one of the most common mistakes when starting out in risk management, and distinguishing them precisely is the basis for any serious analysis: the threat is the potential agent or event that could cause harm, such as an attacker or a natural disaster; the vulnerability is the specific weakness that threat could exploit, such as an unpatched system; the risk is the combination of the likelihood that the threat exploits that vulnerability and the consequences that would result; and the impact is the concrete magnitude of those consequences, measured in financial, operational, legal or reputational terms. In practice, this distinction matters because each concept is treated with different strategies: a vulnerability is fixed with a patch or technical control, while a threat generally can't be eliminated and can only be managed by reducing the vulnerability that would make it effective or mitigating the impact it would produce if it materialized.