Brittle and vulnerable both describe a system at risk, but they name different mechanisms. Use "vulnerable" for exposure to an external attack or harm; use "brittle" for an inability to absorb sustained internal stress or load.
The test: exposed to attack, or unable to absorb load?
"Vulnerable" highlights what can attack it; "brittle" highlights how poorly it bends. One is about an outside actor finding a way in; the other is about the thing's own structure failing under pressure that has nothing to do with an attacker.
"The login service is vulnerable to credential-stuffing attacks because rate limiting is incomplete" names exposure to attack.
"The disaster-recovery setup is brittle under sustained traffic" names inability to absorb load -- a different problem from the login service's exposure, even though both sentences describe risk.
The common mistake: swapping the two and misrouting the ticket
The mistake is swapping the two: naming exposure to attack as "brittle" or naming inability to absorb load as "vulnerable" routes the concern to the wrong team. Calling a security exposure "brittle" instead of "vulnerable" (or vice versa) can send the ticket to the wrong owner -- security and attack-surface work and load-capacity and resilience work are usually different teams with different budgets.
Want to learn "Brittle" in depth?
Lyra Practice teaches advanced non-native professionals the nuance of high-value expressions like this one, then has you practice using them in realistic work scenarios.
Start learning for free →Before filing the report, ask what would actually cause the failure: someone deliberately probing for a weakness, or ordinary load exceeding what the system can handle? The first is "vulnerable," the second is "brittle," and each points at a different fix and a different owner.
Practice scenarios
Practice using brittle in situations like:
- routing a security exposure to the right team by calling it "vulnerable," not "brittle"
- routing a load-capacity issue to the right team by calling it "brittle," not "vulnerable"
- explaining the difference between an external attack risk and an internal load risk
Useful practice phrases:
- "[System] is vulnerable to [attack type] because..."
- "[System] is brittle under sustained [load type]."
- "That's vulnerable, not brittle -- the risk is an attacker, not load capacity."