Threat and Vulnerability

A threat is a potential harmful action or event. A vulnerability is a weakness that can enable harm. An attack is an attempt to exploit a path; these terms describe different parts of a security scenario.

Name the weak link

In a fictional service, the threat scenario is an unauthorized refund. A tool that trusts a supplied order identifier without checking ownership has a vulnerability. The tool interface is part of the attack surface.

This distinction helps assign work: the team can repair the missing ownership check and test requests for another customer's order.

Do not infer an attack from every error

A wrong answer may result from poor retrieval or outdated data without malicious activity. Investigate evidence of the cause while containing the impact. Fixing one vulnerability also does not remove every route to the same harmful outcome.

Reference: OWASP: Threat Modeling.