Should we focus on threats or just vulnerabilities?

Good time of the day,

I think that depends on the situation. For example, if you are deploying high-traffic web applications, then you need to focus on both of em. If you are trying to secure internal network of small organization, then addressing vulnerabilities should be enough.

We must be conscious of the possible ways in which the security may be compromised and not the how the attacker manages to do it.

If you have a secure system then the methods are not for you to be bothered about for .

Vulnerabilities opens the door for attacker and increase the risk that you can threat has increase.

Fixing vulnerabilities is way to minimize threat.

fixing vulnerabilities is reactive action. Threats are reale attacks which should be closely monitored and focused on always.