Vulnerabilities are weaknesses in an organization's security defenses. In a risk assessment, vulnerabilities are identified, and a plan is developed to mitigate them, reducing the associated risks.