“A threat is a category of objects, persons, or other entities that represents a constant danger to an asset”.
“An attack is an act or event that exploits vulnerability”.
Main difference between threat and attack is a threat can be either intentional or unintentional where as an attack is intentional. Threat is a circumstance that has potential to cause loss or damage whereas attack is attempted to cause damage. Threat to the information system doesn’t mean information was altered or damaged but attack on the information system means there might be chance to alter, damage, or obtain information when attack was successful.