Any weakness, administrative process or act, or physical exposure that makes a computer susceptible to exploit by a threat.