the weakest link
expressionsecurity
The chain proverb applied to security: the system's real strength is its most neglected component, not its best one.
Attackers do not duel your strongest control; they route around it - through the unpatched box, the reused password, the helpful human. The corollary shapes strategy: uniform decent coverage beats one magnificent wall with a gap.
A chain is only as strong as its weakest link, and in security the observation is that an attacker chooses where to attack. Effort spent hardening something already strong is wasted if a weaker path exists, because nobody attacks the strong point when a weak one is available.
The practical consequence is that defence is a coverage problem rather than a depth problem. The best encryption in the world does not help if the key is in a repository, and a hardened production environment does not help if the same credentials work on a forgotten staging server with a copy of the data. Attackers enumerate systematically and find the forgotten thing reliably, which is why inventory is a security control.
The metaphor has a real limit worth naming, because taken literally it argues against layered defence. Systems are not single chains: defence in depth means an attacker who breaks one link meets another, and the Swiss cheese model describes that better. The synthesis is that you need both readings, since a single weak link on a path with no other controls is fatal, and a weak link behind two independent ones is a finding rather than a breach.
Also known as: a chain is only as strong as its weakest link