Imagine a small company with a customer portal. An administrator account still uses a weak password, and an attacker tries passwords obtained from previous data breaches. Where is the threat? What is the vulnerability? And what is the risk?

These words often appear together, but they answer different questions. Understanding their relationship makes security scenarios easier to reason through.

Identify what could cause harm

A threat is something capable of causing harm. Here, the attacker attempting unauthorised access is the threat. Depending on the scenario, a threat could also involve malicious software, an insider's actions or a physical event. The key question is: What could go wrong, and what might cause it?

A vulnerability is a weakness that could be exploited. The weak administrator password is the vulnerability in this example. It increases the chance that the attempted sign-in succeeds. The question becomes: What weakness makes the harmful event possible?

Risk connects the possible event to its likelihood and consequences. In this case, the company risks an account takeover that could expose customer information or disrupt its service. The level of risk depends on context: account privileges, existing controls, exposure and the likely impact all matter.

Choose a control that addresses the weakness

A useful response might combine strong authentication, limiting administrator privileges, monitoring suspicious sign-in attempts and checking whether exposed credentials have been reused. Each control has a different job. Strong authentication makes stolen or guessed passwords less useful; monitoring helps detect attempts; limited privileges reduce potential damage.

Do not assume that adding one control makes risk disappear. A good answer considers what remains after controls are applied and whether further action is appropriate.

Practise the three-question method

When reading a Security+ scenario, ask:

1. Threat: Who or what might cause harm?
2. Vulnerability: What weakness could be exploited?
3. Risk: What is the plausible business consequence if it happens?

Try this method with a different example: a lost laptop containing unencrypted sensitive files. The loss or unauthorised access creates the threatening event, lack of encryption is a weakness, and disclosure of data is a potential consequence. The details of the question determine the best next step.

Security+ preparation becomes more effective when you explain why an answer fits a scenario, rather than memorising a list of terms. For structured revision and practice, see the ICT Exam Academy Security+ course.