The probability that a particular threat will occur, either accidentally or intentionally, leaving a system vulnerable and the impact of this occurring.