Can weak security be called a "threat", or should it be "vulnerability" instead?

Hi!

In my college work I have to make a list of threats of a certain environment. Threats, not risks or vulnerabilities. When I google it, it often shows the list of risks or vulnerabilities alongside with threats. For example, weak endpoint security, weak network security, weak passwords.

From the academical perspective, is it wrong if I include them to the list?

My question is: Is it wrong if I include "Vulnerabilities in network security" to the list of Threats? …

called can college cybersecurity endpoint endpoint security environment google list network network security risks security threat threats vulnerabilities vulnerability work