In risk terms, which statement best distinguishes a vulnerability from a threat?

• A. A vulnerability is a weakness that can be exploited; a threat is a potential source of harm.
• B. They are unrelated concepts.
• C. A threat is a weakness that can be exploited; a vulnerability is a potential source of harm.
• D. A vulnerability is a policy.

Answer: (A)

The key idea is that a vulnerability is a weakness in a system that can be exploited, while a threat is a potential source of harm that could exploit that weakness. This distinction means vulnerabilities are flaws inside the system, waiting to be taken advantage of, whereas threats are actors or events that could cause harm by exploiting those flaws. That’s why describing a vulnerability as a weakness and a threat as a potential source of harm matches real risk dynamics. The other statements mix up these roles or treat one as unrelated or as a policy, which isn’t accurate.