> ## Content Index
> Fetch the complete content index at: https://cje.io/llms.txt
> Use this file to discover other available public pages before exploring further.

# The Bar Fight Risk Taxonomy
- URL: https://cje.io/2021/06/27/the-bar-fight-risk-taxonomy/
- Published: 2021-06-27T02:02:54.000Z
- Updated: 2025-05-21T02:22:01.000Z
- Description: After hearing "vulnerability" and "threat" used interchangeably for a >9,000th time I decided to do something about it, and the Bar Fight Risk Taxonomy was born.
- Author: Casey Ellis
- Tags: Security, Learn

> Update: Ricki has put [t-shirts based on this tweet - literally - up in an Etsy store](https://www.etsy.com/au/listing/1029661640/threat-actor-someone-who-wants-to-punch?ref=cje.io). They are 25 AUD and all proceeds go towards helping students and others get into cybersecurity as a career field. Yeet!

A bit of background... Nothing happens without communication; and risk is already a fairly vague and abstract concept (especially in the cyber domain), so I tend to rely heavily on metaphors to explain cybersecurity and risk concepts. 

I also get irrationally annoyed when professionals who are meant to be educating and leading a market fall in to lazy patterns that ultimately leave everyone confused about what they're actually doing. After hearing the words "vulnerability" and "threat" used interchangeably for the >9,000th time, I decided to take action, and the Bar Fight Risk Taxonomy was born.

Situations or experiences that the majority of an audience has experienced, thought about, or seen on television serve as a firm foundation for shared comprehension. Visceral hyperbole draws attention to the subject, immerses the reader in the scenario, and maintains the focus on the object of the illustration. 

This tweet utilized both techniques. Even if the reader has never been in or contemplated avoiding a fight in a pub, this scenario - despite being quite unpleasant - is relatively simple to imagine and very effective for getting the point across.

> Hat tip to the legendary [Jack Daniel ](https://twitter.com/jack%5Fdaniel?ref=cje.io)who has been using a similar fighting analogy to communicate risk concepts for years...

> Patch Tuesday = your weekly gym visit  
> Security stack = your mates at the pub with you  
> APT = a mate who also wants to punch you in the face  
> Air gap = avoiding the pub by staying at home  
> Side channel = your wallet being nicked whilst you are being punched in the face
> 
> — ARJ (@AndrewRJamieson) [April 20, 2021](https://twitter.com/AndrewRJamieson/status/1384355419464732677?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

Exposition out of the way, it went viral quickly, to the point where my friend [Ricki Burke](https://www.linkedin.com/in/cybersecricki/?ref=cje.io) started making t-shirts out of it. Of all the tweets I've sent that made their way onto a t-shirt, I'm quite glad this is the one that did:

[Ricki Burke on LinkedIn: Inspired by Casey Ellis | 189 commentsInspired by Casey Ellis | 189 comments on LinkedIn![](https://storage.ghost.io/c/ec/8a/ec8abb38-39b9-4422-95b9-695b2a5e652e/content/images/icon/al2o9zrvru7aqj8e1x2rzsrca)LinkedInRicki Burke![](https://storage.ghost.io/c/ec/8a/ec8abb38-39b9-4422-95b9-695b2a5e652e/content/images/thumbnail/1624502750618)](https://www.linkedin.com/feed/update/urn:li:activity:6813658391395889152/?ref=cje.io)

I'm clearly not the only one who frequently needs to explain these terms and gets annoyed when they're switched around, especially by those in the space who really ought to know better. 

The original tweet was viewed, liked, and reposted 250,000 times, and it spawned a thread with extensions of what I now refer to as "The Bar Fight Risk Taxonomy", which ranged from the concisely accurate to the deeply snarky and hilarious.

Here's the original tweet:

> threat actor = someone who wants to punch you in the face  
> threat = the punch being thrown  
> vulnerability = your inability to defend against the punch  
> risk = the likelihood of getting punched in the face
> 
> — cje 💉💉 (@caseyjohnellis) [April 19, 2021](https://twitter.com/caseyjohnellis/status/1384277480979124232?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

> My apologies to the tenured risk and GRC professionals who have already identified what appears to be a mistake here... Risk is pseudo-mathematically defined as: Likelihood x Impact. Partially because Twitter has a character limit of 240, and partly because I was thinking about a breach through a "right of boom" lens (i.e. something bad has happened, let's understand why), I descoped Impact as a modifier by considering a successful punch as a notifiable breach... i.e. a pass or fail thing that no-one wants. Daniel Miessler did an excellent job expanding on the alternative treatment of risk in this analogy [in his blog](https://danielmiessler.com/blog/explaining-threats-threat-actors-vulnerabilities-and-risk-using-a-real-world-scenario/?ref=cje.io) but since Twitter is written in pen, not pencil, my somewhat crude Impact = 1 math used in the definition remains unchanged.

Here are some subsequent additions to the thread...

> acceptable risk = your willingness to be punched in the face
> 
> — cje 💉💉 (@caseyjohnellis) [April 20, 2021](https://twitter.com/caseyjohnellis/status/1384353347726057473?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

Acceptable risk definition

> exploit = the fist
> 
> — cje 💉💉 (@caseyjohnellis) [April 20, 2021](https://twitter.com/caseyjohnellis/status/1384353458719891456?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

Exploit definition

> attack surface = the size and shape of your face
> 
> — cje 💉💉 (@caseyjohnellis) [April 20, 2021](https://twitter.com/caseyjohnellis/status/1384353423722573824?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

Attack surface definition

...and on, and on, and on it went...

> Patch Tuesday = your weekly gym visit  
> Security stack = your mates at the pub with you  
> APT = a mate who also wants to punch you in the face  
> Air gap = avoiding the pub by staying at home  
> Side channel = your wallet being nicked whilst you are being punched in the face
> 
> — ARJ (@AndrewRJamieson) [April 20, 2021](https://twitter.com/AndrewRJamieson/status/1384355419464732677?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

> bounty hunter = someone who promises to wear gloves when they punch you if you promise to pay them based on where they punch you  
> bugcrowd = cage fight organiser
> 
> — ec0 || james 🏴‍☠️ (@devec0) [April 20, 2021](https://twitter.com/devec0/status/1384359606378369027?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

Bounty hunter definition

> asymmetric threat = studying this entire thread then getting kicked in the crotch
> 
> — cje 💉💉 (@caseyjohnellis) [April 21, 2021](https://twitter.com/caseyjohnellis/status/1384784202260905986?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

Asymmetric threat definition

> cyberrisk insurance = your mates at the pub betting on if you can "talk that kinda shit" and not get punched in the face
> 
> — cje 💉💉 (@caseyjohnellis) [April 20, 2021](https://twitter.com/caseyjohnellis/status/1384353612990607366?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

Cyber risk insurance definition

> Threat intelligence = “Bob’s going to come at you with a right cross”
> 
> — Bill Kyrouz (@Kyrouz) [April 20, 2021](https://twitter.com/Kyrouz/status/1384325530086895619?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

Threat intelligence definition

> canary = a loud obnoxious friend who is daring everyone to punch them, wearing identical clothes  
> pentest = sparring partner, former welterweight boxer, will hit you until you say stop, no below the belt
> 
> — Picaro Byte (@\_\_picaro8) [April 20, 2021](https://twitter.com/%5F%5Fpicaro8/status/1384369702986715136?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

Pentest definition

> compliance = how you think this all works until you've been punched in the face
> 
> — cje 💉💉 (@caseyjohnellis) [April 20, 2021](https://twitter.com/caseyjohnellis/status/1384503532636672009?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

Compliance definition

> Parameterized query: understanding the proper defensive ninja moves while someone is talking to you all friendly like and then suddenly tries to punch you in the face
> 
> — Jim Manico (@manicode) [May 3, 2021](https://twitter.com/manicode/status/1389296682727264258?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

Parameterization definition

> Risk acceptance = ok getting punched  
>  
> Risk mitigation = practice taking a pinch  
> Risk mitigation = consider guards  
>  
> Risk proactive controls = snipers [pic.twitter.com/mHQTyMdw3R](https://t.co/mHQTyMdw3R?ref=cje.io)
> 
> — SecFightClub (@SecFightClub) [May 3, 2021](https://twitter.com/SecFightClub/status/1389342233858478080?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

Risk acceptance definition

> bad threat intelligence = people are generally mad at you about stuff, and might try to punch you at some point in the future
> 
> — cje 💉💉 (@caseyjohnellis) [April 20, 2021](https://twitter.com/caseyjohnellis/status/1384384078959366146?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

Threat intelligence definition

> CVE = list of known standard punches  
> Port scan = looking around the bar to see what everyone is drinking  
> Bouncer = Firewall  
> Band-aids = Initial post-event remediation  
> Blood = data-loss  
> No memory of the event = Ransomware, must rebuild from backups stored in the memory of pals
> 
> — David Heath (@david\_heath) [April 21, 2021](https://twitter.com/david%5Fheath/status/1384844807768449027?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

Miscellaneous definitions

> CVE=A Chuck Norris movie
> 
> — Mathias (@matthegap) [April 21, 2021](https://twitter.com/matthegap/status/1384809472456110081?ref%5Fsrc=twsrc%5Etfw&ref=cje.io)

CVE definition