# Vulnerabilities
A **vulnerability** is a weakness or flaw in the design or implementation of a system or application that could be exploited by an attacker to compromise its security.
Vulnerabilities can arise from a variety of sources, such as poor coding practices, outdated software, misconfigurations, lack of encryption, or weak access controls. When left unaddressed, these weaknesses can allow attackers to gain unauthorized access, execute malicious code, escalate privileges, steal sensitive data, or disrupt services.
## Vulnerability vs Threat vs Risk
The relationship between vulnerabilities, threats, and risks is essential for assessing and mitigating security issues effectively. This relation exposes that by reducing **vulnerabilities** and implementing security controls, organizations can lower their **risk** exposure to a **threat** as follows:
These concepts can be understood as follows:
* **Vulnerability:** A weakness in a system, process, or person that can be exploited by a threat
* **Threat:** Any circumstance, event, or actor that can cause damage to an organization's information assets
* **Risk:** The possibility of a threat exploiting a vulnerability and generating a negative impact. It is calculated as *Risk = Probability x Impact*
* **Impact:** The negative effect a security incident can have, which can affect confidentiality, integrity, availability, or cause financial or reputational damage
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://kryptocoder.gitbook.io/hacking-knowledge/cybersecurity-basics/vulnerabilities.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
