Most people use these three words interchangeably.

Threat. Vulnerability. Risk.

They are not the same thing.

A threat is a potential danger. You cannot control it.

A vulnerability is a weakness in your system. You can control it.

Risk is the likelihood of a threat exploiting that vulnerability.

Get these wrong in an interview, and you signal one thing immediately: you don't understand how security actually works.