A vulnerability is a condition or weakness in (or the absence of) security procedures, technical controls, physical controls, or other controls that could be exploited by a threat.