What’s the difference between a threat, vulnerability, and a risk?

A threat is an event or action that has the potential to cause harm to an asset. A vulnerability is a weakness or flaw in a system or process that can be exploited by a threat. A risk is the likelihood of a threat exploiting a vulnerability and causing harm to an asset.