Understanding Vulnerability Assessment vs Risk Assessment

Have you ever wondered why some organizations discover security weaknesses but still end up experiencing costly cyber incidents? I used to think that finding vulnerabilities was enough to stay secure.