Do you add threats and vulnerabilities to your risk register?

Sorry for yet another GRC-related post, but this is for those GRC professionals with a functioning program (and not career advice):

I try to keep my risk register down to actual risks - things that can be represented with a threat actor, vector (optional), asset, and impact. Very much aligned with the FAIR ontology. A lot of concerns get sent to us that aren't actually risks but potential threats (a new threat group doing xyz) or things I would categorize …

actor advice asset career career advice cybersecurity down grc impact professionals program register risk risks things threat threat actor threats threats and vulnerabilities try vulnerabilities