Although a vulnerability could put an organization at risk, it doesn't necessarily mean it is in danger. Only when a vulnerability is exploited does it becomes a problem. This exploit may be used accidently by a legitimate user or knowingly by an attacker. For instance, a cat strolling across a user's keyboard might cause a buffer overflow vulnerability that results in a Denial of Service (DoS) attack.