1.4. The Language of Risk
💡 First Principle: Risk is not a vague sense of danger — it is a measurable quantity: the product of how likely a threat is to exploit a vulnerability and how much harm it would cause if it did. Using precise risk terminology enables precise decisions; imprecise language enables argument without resolution.
The CISSP exam uses risk terms precisely. Using the wrong term in a question stem is a deliberate trap. An "asset" is not a "threat." A "threat" is not a "vulnerability." A "vulnerability" is not a "risk." Getting these relationships right is the foundation of Domain 1 and bleeds into every other domain.
⚠️ Common Misconception: Many candidates conflate "risk" with "vulnerability." A vulnerability is a weakness. Risk is the exposure created when a threat can exploit that weakness. A buffer overflow in software that has no network exposure and sits in an isolated lab is a vulnerability, but may represent minimal risk. The same buffer overflow in an internet-facing payment processor is high risk. Same vulnerability — radically different risk.
