A vulnerability would be a misconfiguration of a system that allows the hacker to gain unauthorized access, whereas a risk is a combination of the likelihood that such a misconfiguration could happen, a hacker’s exploitation of it, and the impact if the event occurred.
