In both cases, the hole in the umbrella remains. At this stage in a system's development, there is no way to determine if a vulnerability can be exploited. That is determined later. It must be remembered that threats and vulnerabilities are wholly separate entities. The notion is worth repeating.
Threats are architecture independent and vulnerabilities are architecture dependent.
Yet, there is a tendency to use the terms in error and, more than occasionally, wrongly interchanged. Threats are often confused with vulnerabilities and vice versa. It should be remembered that a vulnerability may be construed as a system weakness while a threat may be thought of as an agent or event that exploits a system weakness . The two wholly separate and distinct entities are in opposition to each other. It is useful to differentiate threats and vulnerabilities in the following manner.