A vulnerability is a flaw or weakness in an asset's design, implementation, or operation and management that could be exploited by a threat. A threat is a potential for a threat agent to exploit a vulnerability. A risk is the potential for loss when the threat happens.