According to the text, risk is equal to the threat of attack, multiplied by the asset at risk and vulnerability.
