Vulnerability can be defined as:

Vulnerability can be defined as:

• A. Intrinsic properties of something that create susceptibility to a source of risk that can lead to a consequence
• B. A fully mitigated risk
• C. The external threat environment
• D. A guaranteed outcome of security measures

Answer: (A)

Vulnerability is the susceptibility of an asset to harm because of weaknesses or gaps in protection. It describes intrinsic properties or conditions that could be exploited by a threat to produce a consequence. This matters because risk arises when a threat has a way to exploit something that can cause harm, so reducing vulnerability lowers potential impact. It’s not the risk itself, nor the external threat environment, nor a guaranteed outcome of security measures. Fully mitigated risk isn’t accurate because some residual risk can remain, and threats or weaknesses can persist in some form. The best choice captures that vulnerability is about the inherent susceptibility that a threat could exploit to cause harm.

Vulnerability is the susceptibility of an asset to harm because of weaknesses or gaps in protection. It describes intrinsic properties or conditions that could be exploited by a threat to produce a consequence. This matters because risk arises when a threat has a way to exploit something that can cause harm, so reducing vulnerability lowers potential impact. It’s not the risk itself, nor the external threat environment, nor a guaranteed outcome of security measures. Fully mitigated risk isn’t accurate because some residual risk can remain, and threats or weaknesses can persist in some form. The best choice captures that vulnerability is about the inherent susceptibility that a threat could exploit to cause harm.