A threat is any potential event or agent that could cause harm to an asset if it occurs. A vulnerability is a flaw, weakness, or gap in a system, process, or control that provides a pathway through which a threat can be realised. The two concepts are distinct but interdependent: a threat without a vulnerability cannot cause harm, and a vulnerability without a threat poses no immediate risk. Together, they define the concept of risk.