Which statement best distinguishes a threat from a vulnerability in a cyber risk assessment?

### Why this is right A risk scenario requires a potential source of harm and a weakness that source could exploit. The threat is the actor or event; the vulnerability is the exploitable weakness. ### The concept An assessment connects threats and vulnerabilities to possible impacts on information. A threat by itself does not establish that a system is vulnerable, and a vulnerability alone does not identify who or what might exploit it. The organization evaluates the resulting possibility of harm, then considers controls and remaining risk. ### The other options - **B. A threat is a weakness; a vulnerability is the harm that occurs.**: This reverses the meaning of threat and vulnerability, and confuses vulnerability with impact. - **C. A threat is residual risk; a vulnerability is an administrative control.**: Residual risk is risk remaining after controls; an administrative control is a measure used to reduce risk. - **D. A threat is an asset owner; a vulnerability is a likelihood rating.**: An owner is responsible for an asset, while likelihood is one factor used to rate risk. ### Terms - **Residual risk**: Risk that remains after controls are applied. - **Administrative control**: An organizational rule or procedure intended to reduce risk. ### Remember A threat may exploit a vulnerability, and the resulting harm contributes to risk.