Not long ago I was working on a threat modeling project, and found that I was rather confused by the distinction between a threat and a vulnerability. This might not seem like a big deal at first, but since the two are dealt with at different stages in the risk...