General wisdom is: error < bug < vuln < poc < wild exploit Yet a narrow security view cantered around single faults within single programs misses a lot. Take

General wisdom is: error < bug < vuln < poc < wild exploit Yet a narrow security view cantered around single faults within single programs misses a lot. Take backdoors, which are neither errors nor bugs, nor may be seen in the wild, but are simply vulnerabilities in waiting, working as expected by design. Or a set of mere errors may, in concert, lead to a systemic and commonly exploited vulnerability. Giving an identifier to a reproducible observation, in some context and time, is a good start. But to be useful it needs to be part of a wider, joined-up taxonomy that helps us understand risk better.