Weaknesses in information systems, system security procedures, internal controls, or implementation that could be exploited by external threats.