the vulnerabilities are:

1-Lack of Proper Control Access

2-Lack of Employee training and awareness

3-Dependence of third-party app and software

4-lack of vulnerability scanning for employee devices

5-Use of remote desktop protocol for network

6-Cloud service provider

the threats are :

1-Employee Error

2-DOs Attacks

3-Malware Attacks

4-Phising Attacks

5-Loss Of Personal Data or IP

*I need to justify the likelihood between them*