The risk factor for an organization is typically calculated by considering the potential impact of a threat exploiting a vulnerability. The formula often used is Risk = Threat X Vulnerability X Impact. This means that for a risk to exist, there must be a threat that could exploit a vulnerability and cause an impact on the organization. An attack is not a parameter in the risk calculation but rather the act that occurs when a threat exploits a vulnerability.