Skip to content

Welcome!

Welcome to vulnbrocards.com, home of the "vulnerability brocard."

See How to use for how to apply vulnerability brocards during security triage, and the Brocards themselves for the full list.

What is a vulnerability brocard?

Tip

See the original blog post for more context.

A vulnerability brocard is an aphorism or concise maxim that can help you analyze the correctness and importance of a software vulnerability report when performing triage.

Vulnerability brocards take their name from legal brocards.

Brocards are useful (both in law and in vulnerability triage) because they can be used to preclude the re-litigation of arguments or well-trodden fundamentals.

Example

Many legal system have a de minimis principle, which precludes legal considerations of trivia or "trifling" matters.

For example, New York has a "trivial defect" standard that is used to evaluate trip-and-fall lawsuits. A judge can use this standard to evaluate the evidence and issue a summary judgement if appropriate, potentially avoiding a lengthy and expensive trial process.

In the same way, vulnerability brocards can help us issue "summary judgments" during vulnerability triage.

Read on to see how you can use vulnerability brocards.