Read a technology news story about a breach and the words vulnerability, exploit, threat, and risk get shuffled like synonyms. In professional security they are four distinct things — and the distinctions aren't pedantry, they're the grammar in which every report, assessment, and job interview is written. One burglary metaphor keeps them straight forever.
The house
- Vulnerability — the broken lock on your back door. A weakness that exists whether or not anyone ever notices it: a software bug, a misconfiguration, a default password. Its existence is a fact about the house, not about the neighbourhood.
- Exploit — the specific technique for opening that broken lock. Not the weakness itself but the working method — often literal code — that turns the weakness into entry. A vulnerability with no known exploit is a broken lock nobody's learned to pick yet; publication of an exploit changes the urgency of everything.
- Threat — the burglar. The actor (or event) with the capability and intent to do harm: criminal groups, state actors, a disgruntled insider — or non-human ones like fire and flood. Threats exist entirely outside your control; you can't patch a burglar.
- Risk — the combination: the likelihood the burglar finds your broken lock, times what you'd lose if they did. Risk is where the other three meet reality — and crucially, it's the only one of the four you manage rather than eliminate.
Now the sentence that ties it together, worth actually memorising: a threat uses an exploit against a vulnerability, creating risk. Every security decision — patching, firewalls, training, insurance — is an attempt to shrink one term in that sentence.
This vocabulary explains real-world prioritisation puzzles. A "critical" vulnerability on an isolated system nobody can reach may carry less risk than a "medium" one on your internet-facing login page. Mature teams don't patch by severity score alone — they patch by risk, which is severity in context. When you hear arguments about CVSS scores versus exploitability, this is the argument.
Two catalogue terms complete the starter kit: CVE is the global numbering system giving each public vulnerability a unique ID (CVE-2026-12345), so everyone worldwide discusses the same flaw; CVSS is the 0–10 severity score attached to it. When a colleague says "there's a 9.8 with a public exploit affecting our VPN," you can now unpack every word of that sentence — vulnerability, its severity, exploit status, and where your risk lives. That's the whole point of the vocabulary: dense, precise sentences under pressure.