What’s the difference between a threat, vulnerability, and a risk?

A threat is a potential event or activity that can cause harm or damage to an organization. A vulnerability is a weakness in a system or process that can be exploited by a threat. A risk is the likelihood that a threat will exploit a vulnerability and cause harm.