Mastering Cybersecurity Fundamentals: Threat, Vulnerability, Risk, Impact, and CVSS Assessment

To build an effective defense strategy, cybersecurity professionals must understand the core terminology that defines system risk. Often confused, concepts like Threat, Vulnerability, Risk, Impact, and Severity represent distinct components of information security management. Understanding how these elements correlate allows organizations to measure exposure accurately and prioritize remediation using standardized frameworks like the Common Vulnerability Scoring System (CVSS).

Defining the Core Concepts

1. Threat (What Could Cause Harm)

A threat is any external or internal force with the potential to cause damage, compromise data, or disrupt operations. Threats exist independently of whether an attack actually occurs.

• Analogy: A burglar walking through a neighborhood searching for homes to break into is a threat.

2. Vulnerability (The Weak Point)

A vulnerability is an underlying weakness, misconfiguration, or flaw in a system, process, or human behavior that can be exploited by a threat.

• Analogy: Leaving the front door of a house unlocked is a vulnerability—it presents no physical barrier against entry.

3. Risk (The Probability of Compromise)

Risk is the mathematical probability that a specific threat will exploit a specific vulnerability to cause harm. Risk balances likelihood against potential fallout.

• Analogy: The chance that the burglar will walk up to the house and try the front door handle represents the risk.

4. Impact (The Direct Consequences)

Impact measures the actual consequences realized if a risk materializes into a security incident. This includes financial losses, operational downtime, legal liabilities, and reputational damage.

• Analogy: If the burglar enters, the impact includes stolen valuables, lost personal documents, and compromised safety.

5. Severity (The Magnitude of Damage)

Severity quantifies how severe the impact is on a structured scale. Minor incidents carry low severity, whereas full system compromises or widespread data breaches carry high severity.

Practical Case Study: Enterprise Phishing Scenario

Consider an organization where an employee receives a highly convincing spear-phishing email impersonating the internal IT support team. The message prompts the employee to click a malicious link and log in to an fake portal to "verify credentials."

• Threat: The malicious threat actor and the automated phishing campaign designed to harvest corporate credentials.

• Vulnerability: Lack of user security awareness training and the absence of mandatory Multi-Factor Authentication (MFA) on corporate logins.

• Risk: High likelihood that an employee will submit credentials, granting unauthorized access to internal networks.

• Impact: Exfiltration of confidential customer data, intellectual property theft, and potential ransomware deployment across the corporate network.

• Severity: High to Critical, due to the massive operational, regulatory, and financial fallout associated with corporate domain compromise.

Assessing Severity Using the CVSS 3.1 Framework

To objectively calculate severity, the industry relies on CVSS v3.1 (Common Vulnerability Scoring System), which yields a score from 0.0 to 10.0 across three metric groups:

[ Base Metrics ] ---> [ Temporal Metrics ] ---> [ Environmental Metrics ] ---> Final Score

By standardizing vulnerability scoring through CVSS, security operation centers (SOCs) can effectively prioritize critical vulnerabilities and allocate patching resources where they matter most.