Combining Threat, Vulnerability, and Countermeasure
Risk arises when a threat exploits a vulnerability. A threat alone, or a vulnerability alone, does not become a risk by itself — risk arises from the combination of the two, and applying a countermeasure matched to that combination lowers the risk.
Against the threat of unauthorized login, with the vulnerability of a weak password, what is the countermeasure?