a threat exploits a vulnerability and can damage or destroy an asset. vulnerability refers to a weakness in your hardware, software or procedures. threats + vulnerability = risk