In this blog post we aim to clarify the difference between each of the three terms, why knowledge of them is important for cybersecurity teams looking to optimise their security posture and deliver an efficient security programme that is best aligned with potential threats and most effective in reducing risk, and therefore potential harm, to their organisation.