What is the difference between vulnerability assessment and threat model?

• A. Vulnerability assessment identifies weaknesses; threat modeling analyzes attack scenarios and risk.
• B. Vulnerability assessment designs defenses; threat modeling tests hardware.
• C. Vulnerability assessment replaces incident response; threat modeling handles compliance.
• D. Vulnerability assessment measures performance; threat modeling assesses user experience.

Answer: (A)

Focusing on weaknesses in a system and on attacker pathways are the two distinct angles in security practice. A vulnerability assessment aims to uncover weaknesses in the system’s configuration, software, or controls—things like unpatched software, misconfigurations, weak credentials, or insecure settings. It’s about finding concrete flaws that could be exploited.

Threat modeling takes a broader view of risk by considering how an attacker might reach the most valuable assets. It maps out potential attack scenarios, attacker capabilities, and the paths an intrusion could take, then assesses the likelihood and impact to decide where mitigations matter most. This helps prioritize defenses based on actual threat combinations rather than just known flaws.

So the best description is that vulnerability assessment identifies weaknesses, while threat modeling analyzes attack scenarios and risk. For example, a vulnerability assessment might identify an outdated library as a weakness; threat modeling would evaluate how an attacker could exploit that library, what data could be at risk, and which mitigations (like patching, access controls, or network segmentation) would most reduce overall risk.

Other options blur who is responsible or mix in unrelated activities—designing defenses, testing hardware, replacing incident response, or measuring performance or user experience—none of which capture the core distinction between finding weaknesses and analyzing attack scenarios and risk.