Five words cause most miscommunication between security and everyone else: critical, affected, exploited, patched and mitigated. Each has a precise meaning in security work and a looser one in daily speech. Agree on definitions once, publish them, and use them the same way in every update.
Why a glossary helps
When support hears "critical," they may expect an outage. When legal hears "exploited," they may assume customer data was taken. When a manager hears "mitigated," they may close the ticket. None of these readings is stupid. They are the ordinary meanings of the words. A one-page glossary removes the guesswork.
The five words
| Word | What security means | Common misreading |
|---|---|---|
| Critical | A severity band. For CVSS v4.0, FIRST lists Critical as 9.0 to 10.0 (FIRST) | It will hurt us badly, right now |
| Affected | The product contains the vulnerable component or behaviour and the status is confirmed as such | The product has been attacked |
| Exploited | An attacker has used the flaw somewhere in the wild, per a source such as CISA's catalog (CISA) | We were breached |
| Patched | The vulnerable software has been replaced with a fixed version | Every customer is now protected |
| Mitigated | Exposure has been reduced while the flaw remains | It is fixed |
Unpacking each one
Critical. FIRST says CVSS measures severity and should not be used alone to assess risk. A critical flaw in a component you do not run, or cannot reach, is not a critical risk for you. Say "critical severity" rather than just "critical" to keep the meaning attached to the score.
Affected. In VEX terms, affected is one of four statuses, alongside not affected, fixed and under investigation (OpenVEX specification). It says the product has the issue. It says nothing about whether anyone attacked it.
Exploited. This is the word most likely to cause alarm. Say where the evidence comes from and whether the exploitation was against you. "Exploited in the wild according to the public catalog" is not the same as "exploited against our systems."
Patched. Distinguish between a patch existing, being built, and being deployed. A patched version in a repository does not protect a customer who has not installed it.
Mitigated. Always follow it with what remains: "mitigated, the underlying flaw is still present, fix due on a date."
Two more worth adding
- Vulnerable versus exploitable. Vulnerable means the flaw is present. Exploitable means an attacker can actually use it in your setup. Reachability analysis and exposure checks bridge the two.
- Risk. In security, risk combines likelihood and impact in a context. A score is an input, not the risk.
How to roll it out
- Put the table in the incident template.
- Ask spokespeople to use the words as defined.
- Review wording in the first update of each event and correct drift early.
- Add terms when questions repeat.
A short test
Give a colleague this sentence: "A critical vulnerability is exploited and our product is affected but mitigated." Ask what they think happened. If their answer differs from the intended one, the glossary needs another line.
Try it yourself
Click through it at your own pace, or open it full screen. Click through and watch the difference between a flaw being present and a flaw being exploitable in context. Those two words, vulnerable and exploitable, are the ones to keep apart.
Where Safeguard fits
Safeguard's dependency scanning and reachability analysis give evidence for the words affected and exploitable. The free scan is at gold.safeguard.sh/scan.
Quick check
Is critical the same as urgent?
No. Critical is a severity band. Urgency depends on exposure, reachability and exploitation evidence.
Does exploited mean we were breached?
No. It may mean the flaw is being used elsewhere. Say whether any evidence concerns your systems.
Sources
Last reviewed: 19 October 2026.
