Whenever you're ready, walk me through how you'd approach this.
What are the key differences between a vulnerability, threat, and risk? Can you give examples of each?
