A weakness in an information security system, system security procedures, security controls, or implementations that could be exploited by a threat actor.