The security mindset

Confidentiality is about who can see a thing. Nothing was destroyed and nothing stopped working, but the secret is out, and that is a confidentiality failure. Availability is having something work when you need it, and integrity is keeping something as it should be. The three are separate, and knowing which one broke usually tells you what to do about it.

A vulnerability is the gap itself: a file with loose permissions, or a service left running. A threat is anything that could cause harm, a risk is a vulnerability meeting a threat weighed by how likely it is and how much it would cost, and an exploit is the method that turns a weakness into harm. The four words are different, and people use them as if they were one.

A device is connected, it runs software written by people, and a person could reach it, so the honest answer to "is this secure" is always "partly". The aim is to reduce blast radius, the damage one failure causes, by limiting what a single broken thing can reach. The other options name things that are not the reason a system is never perfectly secure.

Detection is how you find out that something happened instead of guessing, but a log entry nobody reads and nobody acts on is just text. The value comes when detection leads to a response: stop the service, change the password, remove the file, block the source. Prevention, detection and response go together, and a chain with a missing link is not a chain.