What is the difference between a risk and a vulnerability?

The difference between technical vulnerability and organizational risk.

A vulnerability is a weak spot. A risk is about what that weakness can mean for the organization.

A vulnerability in a test system without sensitive data often has a different risk than the same vulnerability in a public system with personal data. So context is important.

Also read What is a finding?.