A strong cybersecurity plan requires vulnerability assessment and risk management, which this chapter covers. Students learn about vulnerabilities, how they are found, and their effects on systems and networks. The chapter covers vulnerability assessment—identification, analysis, remediation, and verification—using automated and human tools. Students study vulnerability scanning, as well as how to analyze scan results and prioritize remediation by severity and asset value. Risk is then explained, including how to assess risks, vulnerabilities, effects, and likelihood. Risk identification, assessment, mitigation, and monitoring are presented using real-world scenarios. Students study risk reactions like acceptance, avoidance, mitigation, and transference, and how NIST supports organized decision-making. Continuous monitoring and security audits are stressed. Students learn how to detect security gaps, assess impact, and implement controls to decrease corporate risk in this chapter.