Within threat vulnerability management (TVM), the terms ‘vulnerability’, ‘risk’, and ‘threat’ are sometimes used interchangeably, but they have different meanings. Vulnerability: the security weaknesses within an organization’s IT network, e.g. a system misconfiguration. Threat: incidents that could lead to a breach of an organization, e.g. insufficient phishing training for staff. Risk: an evaluation of the impact a threat could have, specific to the organization, e.g. a critical asset is at risk