Absent beats derived

One rule sits under a lot of the work on this site, and it is worth stating plainly. Map things directly, and when you cannot, show a gap rather than a guess. An absent value is more useful than a derived one, because a derived value looks like knowledge and is really a rule firing. Here are three places the rule changed what we ship.

One: economic sectors

We used to turn an industry code into an economic-sector code with a lookup table. It always returned an answer. When we replaced it with a step that classifies each industry directly, the honest result in about one case in five was no clean sector at all, where the table would have asserted one anyway. Those blanks are the improvement. The labels that remain are ones we can defend one at a time.

Two: AI weaknesses

The reference vulnerability catalog almost never tags AI vulnerabilities with the AI specific weakness. Across ninety five prompt injection flaws, it used the correct weakness identifier zero times, filing them under generic injection instead. We author the AI weakness directly on the cases where it applies, and we label it as our reading. We do not infer it from a keyword or borrow it from a neighbor.

Three: controls and attack techniques

The tempting way to connect a software weakness to a defensive control, or to an attacker technique, is to chain through an intermediate catalog: weakness to attack pattern to technique. Each hop drops entries. Run the two most common web weaknesses, cross-site scripting and SQL injection, through that chain and they arrive at zero techniques, which is absurd. So we map weakness to technique and weakness to control directly, and we retired an older path that reached compliance controls by chaining a vulnerability through two intermediate frameworks.

Why derived precision is the dangerous kind

A derived value is internally consistent and often plausible, and it is wrong in ways you cannot audit, because the error lives in a table you never see. It reads as data. It is really a guess wearing a lab coat. The more taxonomies you chain, the more confident and the more detached from the source the output becomes. That is the exact opposite of what you want from a system people make decisions on.

The discipline

Author each mapping directly for the pair it connects. Do not fill a second taxonomy from a first. When the direct answer is not there, show nothing and say so. It makes our pages look a little emptier in places. It also means that when we do put a label on something, it is because someone or something actually classified that thing, and we can tell you which. Absent beats derived.