Question: what is the difference between risk and vulnerability?
Answer: Vulnerabilities are the gaps or weaknesses that undermine an organization's IT security efforts, e.g. a firewall flaw that lets hackers into a network. Risk refers to the calculated assessment of potential threats to an organization's security and vulnerabilities within its network and information systems.