Skip to content
AI Security

Interview question · Security Foundations & Threat Modeling

What is the difference between a threat, a vulnerability and a risk, and how do you prioritise findings?

Three words people use interchangeably, and a prioritisation question that exposes whether you have ever had a backlog of thirty findings.

easyEssentialNewPreparation tags: Amazon, Microsoft, GoogleUpdated Nov 2026

Three words people use interchangeably, and a prioritisation question that exposes whether you have ever had a backlog of thirty findings.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A scanner reports 300 findings across your web estate, and leadership asks which three to fix this week.

  1. How do threat, vulnerability and risk differ?
  2. What does the scanner not know?
  3. How do you prioritise?
  4. What if many findings share a root cause?
  5. How do you explain the choice to leadership?
  6. How would you choose the three?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackA product team wants to ship an LLM feature next week, and the security review is not done. What do you do?Next in this trackExplain an AI security risk to a CISO: the impact, the options, the residual risk and the decision you need.Next in this trackWalk through the incident response lifecycle using a leaked API key as the example.
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.