Software has tons of bugs. A fraction of those bugs are security vulnerabilities. Any type of bug can be considered a defect, and thus can be considered to mak

Software has tons of bugs. A fraction of those bugs are security vulnerabilities. Any type of bug can be considered a defect, and thus can be considered to make the product defective. By using the terminology "defective" instead of "vulnerable" we lose the distinction between security bugs and other bugs. I don't think we want to lose that distinction.