Vulnerabilities can also arise from weak policies and processes, like a lax access control policy that lets people access more assets than they need. Threats include intentional cyberattacks (like ransomware or phishing) and employee mistakes (like storing confidential information in unsecured databases). How a company conducts a risk assessment will …