In risk context, what best describes the relationship between a threat and a vulnerability?

In risk context, what best describes the relationship between a threat and a vulnerability?

• A. The threat creates a vulnerability
• B. Vulnerability is independent of threats
• C. Threat exploits vulnerability
• D. Risk is unrelated to both

Answer: (C)

In risk context, a threat is a potential source of harm, and a vulnerability is a weakness that could be taken advantage of. The relationship described here is that a threat exploits a vulnerability. When a vulnerability exists and a threat can exploit it, a risk event can occur, leading to impact. If there’s no vulnerability, a threat can’t cause harm; if there’s a vulnerability but no credible threat, the risk isn’t realized. For example, an unpatched software vulnerability (weakness) can be exploited by a cyber attacker (threat). The combination of both enables a security incident, illustrating why the correct view is that threats exploit vulnerabilities. Why the other ideas don’t fit: a threat doesn’t create the vulnerability—it exploits an existing one. Vulnerabilities aren’t inherently independent of threats, because risk comes from a threat having a viable path to exploit them. And risk is fundamentally tied to both the presence of threats and the existence of exploitable vulnerabilities; saying risk is unrelated to both would ignore how incidents actually occur.

In risk context, a threat is a potential source of harm, and a vulnerability is a weakness that could be taken advantage of. The relationship described here is that a threat exploits a vulnerability. When a vulnerability exists and a threat can exploit it, a risk event can occur, leading to impact. If there’s no vulnerability, a threat can’t cause harm; if there’s a vulnerability but no credible threat, the risk isn’t realized.

For example, an unpatched software vulnerability (weakness) can be exploited by a cyber attacker (threat). The combination of both enables a security incident, illustrating why the correct view is that threats exploit vulnerabilities.

Why the other ideas don’t fit: a threat doesn’t create the vulnerability—it exploits an existing one. Vulnerabilities aren’t inherently independent of threats, because risk comes from a threat having a viable path to exploit them. And risk is fundamentally tied to both the presence of threats and the existence of exploitable vulnerabilities; saying risk is unrelated to both would ignore how incidents actually occur.