the relationship between risk, threats, and vulnerabilities