Threat, vulnerability, and risk

A team cannot prioritize a problem from a label alone. It needs to distinguish a weakness, an event that could use that weakness, and the resulting harm. A vulnerability is a weakness. A threat is a circumstance or possible event that could cause harm. Impact is the harm if it occurs.

Risk combines the likelihood of an adverse event with its impact. A missing fix can matter differently on a reachable service holding private records and on a disconnected disposable machine. Compare the supplied facts; when likelihood is unknown, say so instead of inventing a percentage.

Before you begin

Recommended first: How a web app is put together, Same-origin policy, Binary, hex, Base64, and URL encoding, Authentication, authorization, least privilege
Estimated time: 14 min reading, 10 min activity. Setup and optional practice may take longer.
Where you work: Read the fictional cards in any current desktop or mobile browser. No installation, account, password tool, directory deployment or network request is required. Use only the evidence supplied on this page.
Without a lab: The page prints the evidence needed for the activity. Write your classifications and reasons in notes, then compare them with the activity rubric. This practices reasoning; it does not reproduce a live incident or tool operation. Reading works without JavaScript. Answer checking requires JavaScript and a secure browser context; saving progress also requires usable browser storage.

After this lesson you can:

Label a sentence as a threat, a vulnerability, or an impact.
Rank two cases from stated reach and stated data, without inventing a probability.
Name one missing fact that would be required before a rank is more than a comparison of the card.

01Example

Compare these fictional cases by reach and data. The same weakness does not automatically produce the same risk. No service was tested.

Shelf: missing fix, reachable on the club network, stores the private budget. Handle this first from these facts.
Scratch: the same kind of missing fix, reachable only inside a disposable machine, no private notes. Handle this after shelf.
No probability is printed. The weakness can match while the concern does not.

02Weakness, event, harm

A missing permission check is a weakness. A possibility that someone will copy private data is an adverse event. Loss of the data's confidentiality is a consequence. Classifying the sentence first keeps you from treating a possible event as something already observed.

Ranking is a decision under stated assumptions. Shelf and Scratch share a missing fix, but differ in reach and data. Those differences justify giving Shelf attention first in this model. A real risk decision would need further evidence about exposure, existing controls and likelihood; these cards supply no numerical probability.

Tell a weakness, a possible adverse event, and a harm apart, then rank only from the facts on the card.Model. A teaching model drawn by hand. It shows the idea, not real tool output.

Read the full explanation below.

samepriority

Field	Shelf	Scratch
Missing fix	Missing fix	Same kind of missing fix
Reachability	Club network	Inside disposable machine
Private data	Private budget	No private notes
Probability	Not supplied	Not supplied

Same weakness

The missing fix matches; a matching weakness does not make context identical.

Follow the explanation

The missing fix matches; a matching weakness does not make context identical.
Shelf has wider reach and private budget data. No probability or numerical risk was supplied.

Read every state and value

1. The missing fix matches; a matching weakness does not make context identical.

Selected Comparison: same
Highlighted Field: Missing fix

2. Shelf has wider reach and private budget data. No probability or numerical risk was supplied.

Selected Comparison: priority
Highlighted Field: Reachability · Private data

The same weakness can have different concern; no probability is supplied.

03Sort three sentences

S1, S2, and S3 are new sentences. The shelf and scratch pair is only the ranking example.

Original fictional statements. No service was tested. No likelihood number is supplied.

Worked pair
Shelf
Weakness: a fix is missing
Reach: the club network can open it
Data: the private budget is stored there
Stated concern from these facts: handle shelf first

Scratch
Weakness: the same kind of missing fix
Reach: only from inside this disposable machine
Data: no private notes
Stated concern from these facts: after shelf
The weakness can match while the concern does not. A missing number is not a probability.

Activity statements
S1: Someone might copy the private budget.
S2: The sign-in page accepts an account without checking a password.
S3: Members would lose the privacy of the budget.

S1 names a possible adverse event.
S2 names a missing check.
S3 names the harm if the budget is exposed.

Check: S1 is a threat.
Do not invent a percentage.

Download the risk cards

Label S1, S2, and S3 as threat, vulnerability, or impact. Use the definitions, not a guessed percentage.
From the worked pair, say which case the printed facts put first, and which fact is missing for a numeric likelihood.
Check: S1 is a threat. Shelf is ahead of scratch because of reach and the private budget.
Stop. Do not probe a service to add facts that the card does not have.

04Optional challenge

Allow about ten minutes. Imagine a new service with a missing update. List two facts you would ask for before comparing it with Shelf: for example, who can reach it and what information it holds. Explain how each fact could change your priority.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Risk case A: independent incident modelOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

W: the note service omits a read-permission check.
E: someone could use that gap to copy private notes.
H: unauthorized readers would learn private material.
These are a stated weakness, possible adverse event and consequence; no actual copying is observed.

Risk case B: supplied priority assumptionsOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Service North: same missing check; reachable by all club members; holds private medical-contact notes.
Service South: same missing check; isolated disposable VM; holds invented test notes only.
Use only reach and data sensitivity to prioritize the next review. No attempt rates, exposure frequencies or probabilities are supplied.

06Explain your prediction

Optional written self-check: Distinguish vulnerability, possible event and consequence. Show which stated facts justify a priority and leave numerical probability unknown when supporting evidence is absent.

07Common mistakes

If you called S1 a vulnerability, you looked for a weakness and the sentence names an event instead.

If you called S3 a threat, you named the harm and skipped the event that might cause it.

If you ranked scratch first because the missing fix matches, you treated the weakness as the whole risk.

Check 1
Use case A. Match each statement to its role in the risk description.
- W: omitted permission check
- E: possible copying
- H: private material learned
Check 2
Use independent case B under its stated assumptions. Which review priority is justified?
Select one line.
- Review North first because more people can reach the weakness and the data is private.
- Equal weakness names force equal priority despite different reach and data.
- Review South first solely because disposable machines always have greater impact.
Check 3
A report gives North a 90% chance of a harmful event based only on case B. What is the strongest supported criticism?
Select one line.
- The card supplies no evidence for a numerical likelihood; more exposure, control and event-frequency information is needed.
- Any private file proves a 100% chance of harm.
- The absence of a recorded incident proves the chance is zero.
Check 4 (optional)
Changed case B: South now holds the only real emergency-contact list and is reachable by all club members; North’s exposure stays as supplied. What should happen to the earlier justification?
Select one line.
- Reassess using the changed reach and data; the original isolated/invented-data justification no longer describes South.
- Keep every earlier conclusion because the weakness name has not changed.
- Declare that South has already suffered an incident.

0 of 3 required checks answered.

Practice

Practice with the supplied security casesRepeat the activity in your notes and explain each decision from the printed facts. No external target or account is needed.

References

NIST CSRC glossary: vulnerability
The first definition is a weakness in a system, procedures, controls, or implementation that could be exploited or triggered by a threat source. The page attributes that wording to FIPS 200 and a close wording to SP 800-115.
NIST CSRC glossary: threat
The first definition is any circumstance or event with the potential to adversely impact operations, assets, or individuals through unauthorized access, destruction, disclosure, modification, or denial of service. The page attributes it to FIPS 200.
NIST CSRC glossary: risk
One definition is a measure of the extent to which an entity is threatened, as a function of adverse impact and likelihood. The page lists several NIST publications for that family of wording.
NIST CSRC glossary: impact
One definition is the effect of a loss of confidentiality, integrity, or availability. Another is the magnitude of harm expected from unauthorized disclosure, modification, destruction, or loss of availability.