A vulnerability is a weakness that a threat actor may exploit.

### Why this is right A vulnerability is a weakness in an information system, such as an unpatched server or weak password. A threat actor may exploit that weakness to harm data or systems. ### The concept A threat actor is a person or group capable of attempting an attack. A vulnerability is the opening that could make an attack possible. The presence of a vulnerability alone does not establish that harm has occurred; risk depends on a threat being able to exploit it and cause an impact. ### Terms - **Threat actor**: A person or group that may attempt to cause harm. - **Exploit**: To take advantage of a weakness. ### Remember A threat is the potential source of harm; a vulnerability is the weakness it may use.