A potential weakness in an asset or its defensive control system(s).