The probability that a specific vulnerability within an organization will be attacked by a threat.