Threat Vs Vulnerability Vs Risk

In Simple language  : forgot the Car key in side the Car is an Vulnerability, threat here is where we put the car & key, in City or Village, ie how potential on vulnerability. Asset value is what kind car we using Maruti or Ferrari  :)  .

The term “vulnerability” refers to the security flaws (Weakness ) in a system that allow an attack to be successful. Threat is the frequency of potentially adverse events.

 Risk = Threat * Vulnerability * Asset Value 

Come to Tech Scenario :Think we left server / laptop unlocked in home or office a vulnerability assessment is the process of identifying and quantifying vulnerabilities in an environment. 

It is an in-depth evaluation of your posture, indicating weaknesses as well as providing the appropriate mitigation procedures required to either eliminate those weaknesses or reduce them to an acceptable level of risk. On the other hand, a pen test simulates the actions of an external and/or internal attacker that aims to breach the security of the organization. Using many tools and techniques, the penetration tester attempts to exploit critical systems and gain access to sensitive data. Depending on the scope, a pen test can expand beyond the network to include social engineering attacks or physical security tests. (White Box, Gray Box, Black Box) (Back Track 5 - OS)