What is the difference between a vulnerability, a threat, and a risk?

A vulnerability is a weakness that exposes your program or organization to possible threats. A threat is an event, usually malicious, taking advantage of vulnerabilities. Risks are potential losses your program or organization could suffer due to a threat.