is vulnerability really a defect?