Risk is the potential for loss or damage of an asset caused by a cyber threat. An organization’s risk can fluctuate due to external and internal environmental factors and incorporates the probability of a negative event and the impact it will have on your infrastructure. A vulnerability is a gap or weakness in your infrastructure or IT security efforts that open you up to potential threats or increased risk. These vulnerabilities can stem from unpatched operating systems, programs and apps running old software versions, or siloed applications plugged into a modern network, as well as from users who might bring infected devices into your network or share sensitive information.