Threats, Vulnerabilities, and Risk

Name the three ideas

• A threat is something that could cause harm—malware, a phishing message, a stolen laptop, or a natural outage
• A vulnerability is a weakness that makes harm easier—an unpatched app, a reused password, or open file sharing
• A risk is the chance that a threat will exploit a vulnerability, and how bad the impact would be

Connect them with an example

If ransomware exists (threat) and your computer skips updates (vulnerability), the risk rises that files become unavailable. Reducing risk means lowering likelihood, impact, or both—for example by updating software and keeping offline backups.

Prioritize what matters

You cannot eliminate every risk. Focus first on high-impact, likely problems: account takeover, phishing, missing backups, and outdated software on devices you use every day.

Write a simple risk note

A short personal checklist can keep priorities clear.

Asset: email account
Threat: credential theft via phishing
Vulnerability: reused password, no MFA
Impact: inbox access, password resets elsewhere
Action: unique password + MFA + report suspicious mail