Question

What is vulnerability and risk?

Answer 1

Vulnerability is some flaw in our environment that a malicious attacker could use to cause damage in your organization. Vulnerabilities could exist in numerous areas in our environments.
Risk is where threat and vulnerability overlap. That is, we get a risk when our systems have a vulnerability that a given threat can attack.

Answer 2

Risk is the possible damage that could result from some current or future process/event. 

Vulnerability is an internal controls, any weakness or flaw in the design, procedure of system security,, and implementation that can be used and result in violation of the system's security policy or a security breach.

hope it helps