How risks are identified
🗄️
Asset
What you are protecting — data, system, or process
+
⚠️
Vulnerability
A weakness that could be exploited
+
🎯
Threat
An actor or event that exploits the weakness