How do attackers break into systems without a password? That is the core problem Security Concepts and the Threat Landscape solve: understanding what bad actors are after, where they find weaknesses, and how they turn those weaknesses into real breaches. Without this knowledge, you cannot design any defence. For the 200-201 exam, this foundation lets you identify threats, prioritise risks, and choose the right controls.
Jump to a section
A simple way to picture Security Concepts and the Threat Landscape
What would happen if you left your front door unlocked every night?
That is the question at the heart of understanding threats, vulnerabilities, and exploits. Think of your home as a computer network. Your door lock is a security control. A vulnerability is like a weak lock that can be picked easily. The threat is the burglar who walks down your street every night, checking every door. The exploit is the specific tool the burglar uses — say, a lock-pick set — to turn that weak lock into an open door.
Your vulnerability isn't the burglar. It is the weakness in your own home: the cheap lock, the unlocked window, the spare key under the mat. The burglar is the threat actor, and they will use an exploit — a technique or tool — to take advantage of that vulnerability. When they succeed, you have a breach. The data they steal? That is your valuables.
Now, your home security system — cameras, alarms, motion sensors — is your defence. In IT, we call that layered security (defence in depth). The burglar might bypass one camera, but if you have a second camera and a loud alarm, they are more likely to give up. Every layer makes the job harder. That is the whole game: identify your weak locks, know who might try them, and block the tools they use before they get inside.
Security Concepts and the Threat Landscape is the foundation for everything else in cybersecurity. You cannot defend what you do not understand. This chapter breaks down three critical ideas: threats, vulnerabilities, and exploits. They form a deadly triangle, and attackers use all three to succeed.
First, a threat is any potential danger that could harm a system, network, or data. Threats can be natural (floods, earthquakes), unintentional (a user accidentally deleting a file), or intentional (a hacker, a disgruntled employee). In the exam, they focus most on intentional threats: people who actively try to cause harm.
Second, a vulnerability is a weakness in a system that a threat can exploit. Vulnerabilities can exist in software (a bug in an operating system), in configuration (a firewall rule that is too permissive), or in human behaviour (a user who clicks every link in their email). The vulnerability is not the attack itself — it is the unlocked door.
Third, an exploit is a specific method or tool used to take advantage of a vulnerability. If the vulnerability is the weak lock, the exploit is the lock-pick. Attackers do not just hope to walk through an open door; they find the open door and walk through it using a tool like malware, a phishing email, or an SQL injection query.
The relationship between these three is fundamental. A threat without a vulnerability cannot cause harm. A vulnerability without a threat is just a weakness waiting to be discovered. The exploit is the bridge between them.
Now, let's get practical. Attackers follow a process called the Cyber Kill Chain, developed by Lockheed Martin. It describes the stages of an attack:
Reconnaissance: The attacker gathers information about the target (finding open ports, employee names, software versions).
Weaponisation: The attacker creates an exploit, like a malicious document attached to an email.
Delivery: The attacker sends the exploit (email, USB drop, web link).
Exploitation: The victim opens the document, triggering the exploit that takes advantage of a vulnerability.
Installation: The exploit installs malware (like a backdoor) on the victim's system.
Command and Control (C2): The malware contacts a remote server to receive instructions.
Actions on Objectives: The attacker steals data, encrypts files (ransomware), or destroys systems.
Understanding this chain helps defenders break the attack at any stage. For example, if you block the delivery stage with good email filtering, the attacker never reaches exploitation.
Another critical concept is the attack surface — the total sum of all vulnerabilities in a system. Every open port, every installed application, every user account adds to the attack surface. Reducing the attack surface means disabling unnecessary services, patching software, and removing unused accounts.
Malware is a common type of exploit. It includes viruses (attached to files), worms (self-replicating), trojans (disguised as legitimate software), ransomware (encrypts data and demands payment), and spyware (steals information). Each has a different behaviour, but all rely on a vulnerability to get in.
Social engineering is another exploit that does not target software at all — it targets people. Phishing (fake emails), pretexting (creating a false scenario), baiting (leaving a USB drive with a malicious file in a car park), and tailgating (following someone through a secure door) are all examples. The vulnerability here is human trust.
Finally, you need to know common threat actors: script kiddies (use existing tools with little skill), hacktivists (hack for political reasons), organised crime (for financial gain), nation-state actors (for espionage or disruption), and insider threats (current or former employees). Each has different motivations, resources, and targets.
To summarise: Threats are the bad guys. Vulnerabilities are the weak spots. Exploits are the weapons. The exam will ask you to identify each part of this triangle in real scenarios and choose the best defence.
Identify the Asset
Before you can defend anything, you need to know what you are protecting. An asset could be a server, a database of customer records, an employee's laptop, or even the company's reputation. Write down a list of all critical assets.
Identify the Threats
For each asset, ask: who or what could harm it? This includes hackers (external threats), employees (insider threats), and natural disasters. List all realistic threats for each asset.
Identify Vulnerabilities
Now look at each asset and find the weaknesses. Is the software outdated? Are there weak passwords? Is the building's server room door unlocked? Each weakness is a potential vulnerability that a threat could exploit.
Analyse the Exploit Path
For each vulnerability, think about how a specific threat would actually use it. What tool or technique would they need? This is the exploit. Understanding the exploit helps you prioritise which vulnerabilities to fix first.
Calculate the Risk
Risk = Threat x Vulnerability x Impact. A vulnerability that is easy to exploit and leads to huge data loss is high risk. A minor vulnerability with low impact is low risk. This step guides where to spend your limited budget and time.
Implement Controls
Choose and deploy security controls to reduce the risk. Controls can be technical (firewalls, antivirus), administrative (policies, training), or physical (locks, guards). Implement multiple layers so one failure does not mean total compromise.
Monitor and Review
Threats evolve. New vulnerabilities are discovered daily. Continually monitor logs, review incidents, and re-assess risks. Update controls as needed. Security is not a one-time project; it is an ongoing process.
Imagine you are the sole IT support person for a small company called 'BrightWave Marketing' with 50 employees. One Tuesday morning, an employee named Sarah receives an email that looks like it is from her bank. The email says her account has been compromised and she must click a link to verify her password. Sarah is busy and worried about her money, so she clicks the link.
She lands on a page that looks exactly like her bank's login screen. She types her username and password. Nothing happens — the page just reloads. Sarah thinks it was a glitch and goes back to work. But by the afternoon, her bank account is empty, and an attacker has her credentials.
Let's break down what happened in terms of threats, vulnerabilities, and exploits.
The threat was the attacker who sent the phishing email. The vulnerability was Sarah's lack of awareness about phishing, as well as the company's lack of email filtering. The exploit was the phishing email itself, designed to trick her into giving up credentials.
Now, as the IT professional, what do you do next? - First, contain the breach. You disable Sarah's network account immediately to prevent the attacker from using her credentials to access company systems. - Second, assess the damage. Check logs to see if the attacker accessed any company resources. In this case, they only got her personal bank credentials, but what if she used the same password for her work email? You check the company's authentication logs for any suspicious activity. - Third, identify the root vulnerability. The vulnerability here was twofold: (a) the email system did not flag the phishing email, and (b) there was no security awareness training. - Fourth, implement controls. You deploy email filtering to block known malicious links and domains. You also schedule a mandatory cybersecurity awareness training session for all employees next week, covering how to spot phishing emails. - Fifth, monitor for recurrence. Over the next month, you check how many employees report suspicious emails. You also implement a 'report phishing' button in the email client.
Three months later, a different employee gets a similar email. This time, they recognise the red flags (generic greeting, urgent tone, misspelt domain) and report it to you without clicking. The control worked.
This scenario shows exactly what an IT professional does daily: identify what the threat is (phishing), find the vulnerability (lack of training), understand the exploit (the email), and then put controls in place to prevent it from happening again. The 200-201 exam expects you to think through exactly this kind of chain of events.
The 200-201 exam tests Security Concepts and the Threat Landscape in several specific ways. First, you will be given a short description of an incident and asked to identify whether the description refers to a threat, a vulnerability, or an exploit. This is the most common question type. The trap is mixing them up. Remember: a vulnerability is a weakness, a threat is a potential danger, an exploit is the action or tool used to take advantage of the weakness.
Second, you will see scenarios that ask you to identify the stage of the Cyber Kill Chain. For example: 'An attacker gathers employee email addresses from LinkedIn. Which stage is this?' The answer is Reconnaissance. The trap here is confusing Reconnaissance with Delivery. Gathering info is Reconnaissance; sending the email is Delivery.
Another trap is around the definition of an attack surface. They might ask you what reduces the attack surface. Disabling an unused service reduces it. Installing a new application increases it. The exam loves this concept.
Key concepts to memorise:
Vulnerability: a weakness in a system that can be exploited.
Threat: any potential danger (natural, unintentional, intentional).
Exploit: a specific method or tool used to leverage a vulnerability.
Risk: the likelihood that a threat will exploit a vulnerability.
Attack surface: the total sum of all exploitable vulnerabilities.
Cyber Kill Chain stages: Reconnaissance, Weaponisation, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives.
Types of malware: virus, worm, trojan, ransomware, spyware, rootkit.
Social engineering types: phishing, spear phishing (targeted), whaling (aimed at executives), vishing (voice), smishing (SMS), pretexting, baiting, tailgating.
Threat actors: script kiddies, hacktivists, organised crime, nation-state, insider threats.
You will also see scenario-based multiple-choice questions like: 'A company's firewall has a configuration error that allows traffic from an untrusted network. An attacker uses a scanning tool to map the internal network. Which terms describe the configuration error and the scanning tool?' The correct answer pairs 'vulnerability' with 'exploit'.
The exam loves to test the difference between a 'threat' and a 'vulnerability'. A common trap question: 'Which of the following is a threat?' with options like 'an unpatched server' (that is a vulnerability) and 'a hacker using a password cracker' (that is a threat and an exploit). If the answer describes a person or event, it is likely a threat. If it describes a weakness, it is a vulnerability.
Finally, memorise the three categories of threats: natural, unintentional, intentional. For example, a hurricane is a natural threat. An employee accidentally deleting a file is unintentional. A hacker launching a DDoS attack is intentional.
A vulnerability is a weakness; a threat is a potential danger; an exploit is the tool or method used to take advantage of the weakness.
The Cyber Kill Chain has seven stages: Reconnaissance, Weaponisation, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives.
Reducing the attack surface (disabling unused services, patching software, removing unnecessary accounts) is a fundamental security principle.
Malware types include viruses, worms, trojans, ransomware, spyware, and rootkits, each with different propagation and payload behaviours.
Social engineering exploits human psychology, not software vulnerabilities, and includes phishing, vishing, smishing, pretexting, baiting, and tailgating.
Threat actors range from script kiddies and hacktivists to organised crime groups, nation-state actors, and insider threats, each with distinct motivations and resources.
Risk is the likelihood that a threat will exploit a vulnerability; understanding risk helps prioritise which vulnerabilities to fix first.
Layered security (defence in depth) means using multiple controls so that if one fails, others still provide protection.
The exam will ask you to classify real-world scenarios into threat, vulnerability, or exploit, and to identify the correct Cyber Kill Chain stage.
Natural threats (floods, fires) and unintentional threats (human error) are also part of the threat landscape, not just malicious hackers.
These come up on the exam all the time. Here's how to tell them apart.
Threat
A threat is a potential danger or harmful event (e.g., a hacker, a fire).
Threats are external to the system (the danger comes from outside).
A threat cannot be 'patched'; it can only be defended against.
Vulnerability
A vulnerability is a weakness inside the system (e.g., unpatched software, weak password).
Vulnerabilities are internal to the system (the weakness is within).
A vulnerability can be fixed by applying a patch, changing a configuration, or improving processes.
Phishing
Phishing emails are sent to many people at once, like spam.
The message is generic ('Dear Customer') and not personalised.
Phishing relies on volume; only a few victims need to fall for it.
Spear Phishing
Spear phishing targets a specific individual or small group.
The message is personalised with the victim's name, job title, or other details.
Spear phishing requires more research but has a higher success rate.
Virus
A virus attaches itself to a legitimate program or file.
It requires user action (like opening a file) to activate and spread.
Viruses often corrupt or modify files on the infected system.
Worm
A worm is a standalone program that does not need to attach to a file.
It spreads automatically over the network without any user interaction.
Worms often consume network bandwidth and may carry a payload like ransomware.
Hacktivist
Hacktivists are motivated by political or social causes.
They typically seek to embarrass or disrupt, not to stay hidden long-term.
Their attacks often use well-known tools and techniques (DDoS, defacement).
Nation-State Actor
Nation-state actors are motivated by espionage, sabotage, or geopolitical advantage.
They prioritise stealth and persistence, often remaining undetected for months or years.
Their attacks use advanced, custom-made tools and zero-day exploits.
Mistake
A vulnerability and a threat are the same thing.
Correct
A vulnerability is a weakness in the system (like an unlocked door). A threat is something that could exploit that weakness (like a burglar). They are different concepts that must both exist for an attack to succeed.
People use the words 'threat' and 'vulnerability' interchangeably in daily conversation, so it feels natural to treat them as synonyms. The exam deliberately draws a sharp distinction.
Mistake
Once a vulnerability is patched, the threat is gone forever.
Correct
Patching the vulnerability removes that specific weakness, but the threat actor still exists and may find a different vulnerability to exploit. Threats are persistent; vulnerabilities are temporary openings.
It is comforting to think a single fix solves the problem. But threats adapt, so security must be continuous.
Mistake
Social engineering only happens through email.
Correct
Social engineering can happen via phone (vishing), text (smishing), in person (tailgating, impersonation), or even through social media direct messages. Email is just one delivery method.
Most awareness training focuses on phishing emails, so learners forget about other channels.
Mistake
Antivirus software prevents all exploits.
Correct
Antivirus detects known malware signatures but cannot block zero-day exploits (new, unknown vulnerabilities) or social engineering attacks. It is one layer of defence, not a silver bullet.
Marketing for antivirus products makes them sound all-powerful. The exam tests your understanding of layered security.
Mistake
Only external actors are threats.
Correct
Insider threats — current or former employees, contractors, or partners — can cause just as much damage, sometimes more, because they already have legitimate access to systems.
News stories focus on external hackers, so beginners overlook the danger from within.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A threat is a potential danger (like a hacker), while a vulnerability is a weakness (like an unpatched server). The threat exploits the vulnerability to cause harm.
An exploit is a specific tool, technique, or piece of code that takes advantage of a vulnerability. For example, a phishing email is an exploit that targets a human vulnerability (lack of awareness).
Yes. The exam will test you on the order of the stages and ask you to identify which stage a described action belongs to. Focus on Reconnaissance, Delivery, Exploitation, and Actions on Objectives.
The attack surface is the total sum of all vulnerabilities in a system or network. Every open port, running service, and user account adds to it. Reducing the attack surface lowers the chance of a successful attack.
Yes. Social engineering exploits human psychology rather than software bugs. Phishing, pretexting, and tailgating are all social engineering exploits that target people as the vulnerability.
An insider threat comes from someone who already has legitimate access (an employee, contractor, or partner). An external threat comes from outside the organisation. The key difference is whether the actor already has authorised access.
You've finished Security Concepts and the Threat Landscape. Continue through the 200-201 study guide to build a complete picture of the exam.
Done with this chapter?