Threat Vs Vulnerbility

Recently i was sitting with few of my friends from the industry and i was surprised to learn that even people with more than 10 years of working experience were confused when it came to differentiating between threat and vulnerability. Much of that confusion has to be credited to the fact that these two terms are mostly used in combination and are often mistook for being the same, Well they are not and today I shall humbly try to explain and differentiate between the two.

THREAT would be something or someone which can take advantage of any weakness of you or your business to gain unfair advantage.

VULNERABILITY is the possible weakness which any threat can exploit to harm you or your business.

In a common office environment getting your computer infected by a virus would be a possible threat while not updating your antivirus or not having any anti virus at all would be a vulnerability which a virus can take advantage off.

It's not necessary that every vulnerability has a threat, What i am talking about? Well very simple real life example should relate my point across to you. Lets me give you example of my young son inside the boundry of our house, he plays around in the secure boundary and we are not that much concerned but he is vulnerable as in he may fall or hurt himself etc etc but certainly no "threats" now slight change of scenario and place my son in a public place with other elder kids and suddenly we have the very same vulnerable child with different threats (other older kids for exmaple) that we have to look out for and be concerned.

Although we continued to discuss many other topics but the above example and discussion did cleared out the misconception to the participants of that coffee meeting, I hope it does the same for the readers of this post.