The risk factor for an organization is typically calculated by considering the potential impact of a threat exploiting a vulnerability. The formula often used is Risk = Threat X Vulnerability X Impact. This means that for a risk to exist, there must be a threat that could exploit a vulnerability and cause an impact on the organization. An attack is not a parameter in the risk calculation but rather the act that occurs when a threat exploits a vulnerability.
References: The information is based on the principles of risk assessment and management as outlined in the EC-Council's Certified Network Defender (CND) course materials, which emphasize the importance of understanding threats, vulnerabilities, and their potential impact to calculate risk effectively12.