A vulnerability is?

• A. The degree of risk
• B. The possibility of an act
• C. The likelihood of detection
• D. The strength of a barrier

Answer: (B)

A vulnerability is a weakness or gap in security that could be exploited by a threat to cause harm. It describes the exposure that exists because defenses are incomplete or ineffective, creating the possibility that an act could be carried out through that weakness. This isn’t the overall risk itself, which also involves how likely the threat is and the potential impact; it isn’t the likelihood of detection, which concerns how easily an intrusion might be noticed; and it isn’t the strength of a barrier, which is a protective control that reduces exposure. For example, an unlocked med room door is a vulnerability because it creates an opportunity for unauthorized access; the associated risk would weigh how likely someone is to exploit that opportunity and what harm could result, while a secure door or alarm would represent a control that mitigates the vulnerability.