1. The possibility that a particular threat will exploit a particular vulnerability of a data processing system. 2. The likelihood that a successful attack will be mounted against a computer system. Risk is a function of both vulnerability and threat.