Degree of vulnerability of a piece of data, an information technology resource or an information system to an attack or a failure.