This page clarifies four terms you hear constantly in cybersecurity, often used interchangeably by mistake: threat, risk, vulnerability and attack. It is for anyone who has to prioritise a fix, talk with a security team or read an audit report without getting lost in the vocabulary. You will find the precise definition of each term, two concrete scenarios that show how they fit together, the vocabulary of the French EBIOS Risk Manager method to tie a risk to the business, the four ways to treat a risk, and an introduction to the threat modeling methods (STRIDE, PASTA, MITRE ATT&CK) used to anticipate threats before they turn into incidents.
What you will learn
This page lays down the basic vocabulary of security management. By the end, you will be able to:
- Distinguish a vulnerability, a threat, an attack and a risk without mixing them up.
- Apply the formula Risk = Likelihood × Impact to a concrete case.
- Analyse a real scenario to identify which link in the chain failed.
- Tie a risk to the business with the EBIOS Risk Manager vocabulary: business asset, supporting asset, risk origin, target objective, security needs.
- Choose among the four risk treatment options: reduce, avoid, transfer or accept.
- Recognise the main threat modeling methods (STRIDE, PASTA, MITRE ATT&CK) and know which one to choose for a given context.
- Avoid the classic mistake of believing that a fix removes all risk.
Vulnerability, threat, attack, risk: four concepts to tell apart
Before diving into the details, let us see how these four concepts fit together. Picture a house: a window that does not close properly is a vulnerability. A burglar in the neighbourhood is a threat. The moment they climb in through that window is an attack. Risk assesses how likely that is to happen and what the consequences would be if it did.
An exploitable weakness
A vulnerability is a weakness in a system, a process or an organisation. It exists independently of any malicious intent. It is an open door: the problem starts when someone decides to walk through it.
Vulnerabilities can be technical (a web server without authentication, a password stored in plain text), human (an employee never trained to spot phishing), or organisational (no code review process).
What characterises a vulnerability is that it exists even without an attacker. It persists until it is fixed or mitigated. Its severity depends on what it allows: merely reading data, modifying it, or taking full control.
A potential danger
A threat is an actor or an event capable of exploiting a vulnerability. It represents the who or the what that could cause damage.
Threats fall into several categories. Human actors include cybercriminals, malicious employees, hacktivists and nation-states (their profiles are detailed in Who attacks and why? (in French)). Natural events such as fires, floods or power outages are threats too. Technical failures (hardware breakdowns, data corruption) and human errors (accidental deletion, misconfiguration) complete the picture.
A threat exists independently of whether a vulnerability is present. A motivated attacker remains a threat even if no flaw is currently known in your system. They are simply waiting for an opportunity.
Exploitation in action
An attack is the concrete realisation of a threat that exploits a vulnerability. It is the act itself, the moment the conditions come together to cause real damage.
An attack needs three elements at the same time: an exploitable vulnerability, a capable and motivated threat, and an opportunity (access to the system, a window of time). Without a vulnerability, no exploitation is possible. Without an active threat, no attack. Without an opportunity, the attacker cannot act.
Vulnerability: Web application without input validation +Threat: External attacker with SQL knowledge +Opportunity: Application exposed on the Internet =Attack: SQL injection allowing data extractionThe combination of factors
Risk is the central concept of security management. It is what you assess, what you prioritise, and what you manage day to day. Formally, risk combines the likelihood that a threat exploits a vulnerability, multiplied by the impact that would cause.
Risk = Likelihood × Impact
This formula is a simplification of the ISO/IEC 27005:2022 standard, the international reference for information security risk management, which defines the level of risk as the combination of likelihood and consequences: the assessment can be qualitative (critical, high, medium, low) or numeric, and multiplication is only its most common form. Its 2022 version refined the definition of a threat: it now speaks of a "risk source" able to exploit a vulnerability to reach the supporting assets of a business process, a nuance that brings risk analysis closer to business stakes rather than technical assets alone.
Risk is not binary. It can be measured, compared, and above all managed. You cannot eliminate every risk, but you can reduce them to a level acceptable to the organisation.
To assess a risk, ask yourself four questions: What weakness exists (vulnerability)? Who could exploit it (threat)? How likely is it to happen (likelihood)? What would the consequences be if it were exploited (impact)?
Learning by example: two concrete scenarios
Theory makes sense once you apply it to real situations. These two scenarios show how the concepts of vulnerability, threat, attack and risk fit together in practice, and how different decisions lead to opposite outcomes.
Scenario 1: when risk is underestimated
A team discovers a vulnerability in a library used by the main application. The fix requires a major upgrade that would break existing features. The team decides to postpone the fix until "after the release".
Three weeks later, an attacker exploits that very vulnerability on thousands of systems worldwide. The application is compromised.
Analysis of the situation:
The vulnerability existed and the team knew about it. The threat (attackers exploiting this flaw) was real and active: other organisations were already being targeted. The risk was underestimated because the business impact of the upgrade felt more concrete than the risk of an attack. The attack happened because the window of opportunity was open.
Scenario 2: when risk is managed deliberately
An organisation runs a legacy system (old, still in production, but that nobody dares to touch anymore) that is critical for accounting. This system has known vulnerabilities but cannot be upgraded without an 18-month migration project.
Rather than ignoring the problem or panicking, the team makes structured decisions: isolate the system on a dedicated network segment, restrict access to the users who need it, monitor any abnormal activity, and plan the migration with an allocated budget.
Analysis of the situation:
The vulnerability persists: it has not disappeared. The threat is still present, attackers could still target this system. But the risk is significantly reduced by the compensating controls. The residual risk is accepted knowingly, documented, and tracked. This trade-off between an immediate fix and compensating controls is a daily exercise in security: the page Security, a matter of trade-offs explains how to handle it without settling for a binary fix-or-ignore choice.
How these notions fit together
The diagram below shows the relationship between these four concepts. A threat can only cause damage if it finds a vulnerability to exploit. That exploitation is the attack. Risk assesses the likelihood of this chain of events and its consequences.
Finding where this chain can be broken, by fixing the vulnerability, by reducing exposure to the threat, or by removing the opportunity, is precisely the goal of threat modeling: anticipating the attack before it happens rather than discovering it in production.
How do you tie a risk to the business: the EBIOS Risk Manager vocabulary
EBIOS Risk Manager (EBIOS RM) is the French method for assessing and treating digital risk, published by the ANSSI, the French national cybersecurity agency, with the support of the Club EBIOS. Its guide, in version 1.5 of September 2024, aligns with the ISO/IEC 27005:2022 standard already cited above. On top of the vulnerability, threat, attack and risk quartet, it adds a vocabulary that starts from what the organisation wants to protect rather than from the technology: this is what lets you talk about risk with management. The guide itself is published in French.
| EBIOS RM term | ANSSI definition, in plain words | Example |
|---|---|---|
| Business asset (valeur métier) | A component that matters to the organisation in carrying out its mission: a service, a support function, information or know-how | The online ordering of a shop |
| Supporting asset (bien support) | A component of the information system on which a business asset relies, whether digital, physical or organisational | The web server, the database, the admin team |
| Security need (besoin de sécurité) | A security property to guarantee for a business asset: availability, integrity, confidentiality, traceability | Ordering must stay available during opening hours |
| Risk origin (source de risque, SR) | An element, person, group or organisation able to give rise to a risk, characterised by its motivation, resources and skills | A criminal group, a competitor, an employee |
| Target objective (objectif visé, OV) | The goal pursued by a risk origin, according to its motivations | Steal data for profit, take revenge, block operations |
Read the table from top to bottom as a chain that starts from the business. A business asset relies on supporting assets, and that is where vulnerabilities weigh. Each asset has security needs (what must not be lost), close to the CIA triad (in French). On the other side, the risk origin and its target objective form a pair that sharpens the threat: no longer a vague danger, but a precise actor who wants something precise.
This reading makes the discussion more concrete. Instead of saying "our server has a critical flaw", you say "a criminal group (risk origin) wants to resell our customer data (target objective) through the web server (supporting asset), which would destroy trust in ordering (business asset)". The detailed profiles of risk origins, their motivations and their means are described in the lesson Who attacks and why? Actors and motivations (in French): this page only gives the vocabulary.
What can you do about a risk: the four treatment options
Once a risk is assessed, you must decide what to do with it: reduce it, avoid it, transfer it or accept it. The ISO/IEC 27005:2022 standard describes four treatment options (risk modification, avoidance, sharing and retention) that the table lists under their everyday names, and the EBIOS RM method applies them in its last workshop, risk treatment, which produces a risk treatment plan. The table illustrates them on the web server of the previous example.
| Option | What you do | Example | What remains |
|---|---|---|---|
| Reduce | Lower the likelihood or the impact with controls | Fix the flaw, isolate the server, set up backups | A residual risk |
| Avoid | Remove the activity or feature that carries the risk | Remove an exposed feature nobody uses | No risk, but no service either |
| Transfer | Have a third party bear part of the risk | Take out cyber insurance, outsource hosting to a provider | The organisation's responsibility and image |
| Accept | Decide knowingly to do nothing more | Keep an old system isolated while waiting for its migration | A documented, tracked and owned risk |
Each option has a limit you need to know. Reducing never brings risk to zero: a residual risk remains, which must then be accepted or reduced further. Transferring mostly moves the financial burden: insurance pays part of the damage, it restores neither the data nor the reputation. Accepting only makes sense if the decision is taken by the person who bears the responsibility, with acceptance thresholds written in advance. EBIOS RM suggests, for example, sorting each risk into three levels: acceptable, tolerable under control, unacceptable.
The legacy system scenario combines two of these options: isolation and monitoring reduce the risk, then the remaining risk is accepted and tracked. The page Security, a matter of trade-offs details how to arbitrate between these options when resources are short.
Threat modeling: anticipate rather than react
Rather than reacting to attacks, mature teams anticipate threats through systematic analysis. Threat modeling answers three fundamental questions: What are we protecting?, Against whom?, and How could they attack?
Several methodologies exist, each suited to a different context. The choice depends on the complexity of the system, the team's skills, and the goals of the analysis.
The Microsoft method
STRIDE sorts threats into six types, forming an acronym that is easy to remember. This systematic approach makes sure nothing is forgotten when analysing a system.
For each component of your architecture, ask the question: "Which STRIDE threats apply here?" An authentication server will be especially concerned by Spoofing (identity impersonation). A public API by Denial of Service. A database by Information Disclosure.
| Type | Meaning | Example | Control |
|---|---|---|---|
| Spoofing | Identity impersonation | Forged JWT token | Strong authentication |
| Tampering | Data alteration | Log modification | Integrity, signatures |
| Repudiation | Denial of an action | "I didn't do that" | Non-repudiable logging |
| Information Disclosure | Information leak | Intercepted plain-text data | Encryption, access control |
| Denial of Service | Denial of service | Resource exhaustion | Rate limiting, scaling |
| Elevation of Privilege | Privilege escalation | User becomes admin | Least privilege, separation |
When to use it: ideal for systems with clear data flows, or to introduce a team to threat modeling. The guide Threat modeling with STRIDE covers hands-on practice: fitting it into sprint planning, producing a threat tree, and turning the results into backlog tickets.
The business-oriented approach
PASTA (Process for Attack Simulation and Threat Analysis) is a 7-step methodology that aligns security with business goals. Unlike STRIDE, which focuses on technical aspects, PASTA starts by understanding what has value for the organisation.
-
Define the objectives, Align security and business goals: what are we trying to protect, and why?
-
Define the technical scope, Map the infrastructure involved
-
Decompose the application, Identify data flows and trust boundaries
-
Analyse the threats, Identify the threats specific to the organisation's context
-
Analyse the vulnerabilities, Scan and correlate with the threats identified
-
Model the attacks, Build attack trees showing the possible paths
-
Analyse risks and impacts, Prioritise by business impact, not only technical impact
When to use it: for complex projects where business impact must guide how security effort is prioritised.
Attackers' real techniques
The MITRE ATT&CK framework, maintained by MITRE, an American non-profit research center specialised in cybersecurity, does not offer a threat modeling methodology as such, but catalogues the techniques actually used by attackers, observed in the field and documented from real incidents. It is a valuable knowledge base for checking that your controls cover real threats, not just theoretical scenarios.
Techniques are organised by tactic (the attacker's goal at each stage):
| Tactic | Description | Example techniques |
|---|---|---|
| Initial Access | Initial access to the system | Phishing, exploitation of exposed services |
| Execution | Run malicious code | PowerShell, scripts, containers |
| Persistence | Maintain access | Scheduled tasks, created accounts |
| Privilege Escalation | Gain more rights | Exploitation of local vulnerabilities |
| Defense Evasion | Avoid detection | Disabling antivirus, obfuscation |
| Credential Access | Steal credentials | Memory dumping, keylogger |
| Lateral Movement | Move through the network | Pass-the-hash, RDP |
| Exfiltration | Extract data | Encryption, alternative channels |
This framework is not frozen: it is updated several times a year as new techniques are documented. Version ATT&CK v19 (April 2026), for instance, split the Defense Evasion tactic into two distinct tactics, Stealth (blending into legitimate activity) and Defense Impairment (actively disabling defences, such as shutting down a firewall or killing a security agent), a finer distinction that the table above deliberately simplifies to stay readable on a first pass. The same version also added techniques related to attackers' use of artificial intelligence tools, a sign that the framework now follows real changes in attackers' methods. The current version, ATT&CK v20 (13 October 2026), lists fifteen Enterprise tactics, including these two.
Practical use: during threat modeling with STRIDE or PASTA, use ATT&CK to check that your controls cover the real techniques relevant to your environment.
Key points
These four concepts form the basic vocabulary of security management. Mastering them lets you reason correctly about priorities, communicate effectively with security teams, and make informed decisions.
- A vulnerability is a technical, human or organisational weakness that exists independently of any attack.
- A threat is an actor or an event able to exploit a vulnerability, intentional or not.
- An attack is the act itself: the concrete exploitation of a vulnerability by a threat.
- Risk combines likelihood and impact: Likelihood × Impact is its simplest form, while the ISO/IEC 27005:2022 standard speaks of a combination of likelihood and consequences.
- A fix reduces risk, it never eliminates it entirely: risk management is continuous.
- EBIOS Risk Manager ties risk to the business: a business asset relies on supporting assets, has security needs, and a risk origin pursues a target objective.
- An assessed risk is treated in four ways: reduce it, avoid it, transfer it or accept it, the last one requiring a documented decision.
- Threat modeling (STRIDE, PASTA, MITRE ATT&CK) lets you anticipate threats before going to production rather than react after the fact: STRIDE suits learning and technical flows, PASTA business alignment, and ATT&CK the validation of the real coverage of your controls.
Knowledge check
Check that you have the essentials of this guide. The questions cover only what has just been explained here.
Knowledge check
Check what you have learned with this interactive quiz
How it works
- The timer starts when you click Start
- Multiple choice, true/false and short answer questions
- You can move between questions
- Detailed results are shown at the end
Starts the quiz and the timer
Review
(0/0)Score by domain
A domain groups several guides and gets several questions, so its score is more reliable than a per-topic score, which often rests on a single question.
Summary
Strengths
No topic passed at 80% on at least two questions yet.
Weak areas
No topic below the pass mark.
Recommended next
Hints before you try again?
Continue the course: Attack surface: what your system exposes
A new full quiz with random questions
Work again only on the questions you missed
FAQ: frequently asked questions
These short answers cover the questions that come up most often about the difference between a threat, a risk and an attack, and about choosing a threat modeling method. Each one stands on its own.