Which one comes first? vulnerability or threat? 🤔🤔 I would go with vulnerability how about you guys?

Yeah

First comes not using hashtags here. It's not Twitter.

Then it depends. There are known standard threats like dictionary password attacks where salting passwords is the solution. Or that databases could be vulnerable so the solution is not to store plain text passowrds, but hashes of salted passwords. The point is, you know these generic threats before you start developing.

On the other hand, there are specific threats that exploit let's say a buffer overflow if you put in certain app specific data at a certain point. Here the vulnerability exists first, then an exploit is crafted which becomes a threat.

I had an exam recently about this. Threat can be anything even if you're unaffected but a vulnerability is only if you're affected.

Vulnerability. If you don't have vulnerabilities then what threats would you have? Because there is nothing to exploit...

@Jason extractly