A vulnerability is a weakness that exposes your program or organization to possible threats. A threat is an event, usually malicious, taking advantage of vulnerabilities. Risks are potential losses your program or organization could suffer due to a threat.