Language Matters

The words we use influence how people think. Shifting language shifts mindsets.

"Vulnerability" sounds like weather: unpredictable, nobody's fault. "Product defect" names something a manufacturer built and could have prevented. Keep it only where it's a term of art, like CVE.

Attacker-centric terms like "arbitrary code execution" describe what the attacker achieved. Software-centric alternatives like "improper input neutralization" describe what the manufacturer failed to prevent.

Discussion prompts

• How does the language in your CVE records and security advisories frame responsibility?
• Who benefits when we describe a breach as a "sophisticated attack" rather than a "preventable product defect"?
• What security terms does your organization use that center the attacker rather than the manufacturer's responsibility?