Accordingly, the Research view seeks to achieve repeatability, although strong technical knowledge and an understanding of chains is required. Repeatability has been informally verified in many situations in which two separate CWE team members classified issues the same way. However, there are limits - ambiguous classification can still happen because of perspective issues or incomplete parts of the hierarchy.
In the case of the Development view, it is hoped that the large number of navigation categories will make it easier for people to reach the desired weakness ID. However, with so many categories, there is a risk of incomplete or incorrect mappings if one user follows one path of the tree, and another mapper follows a different path. Guidance will need to be written, or the tree structured in a way that minimizes this risk. Ultimately, the mapping consistency problem in the Development view could be addressed by improving search capabilities, ensuring that all categories are complete, creating additional categories to fill perceived gaps, and conducting usability studies.
Unified Perspective
By defining a narrow audience and subset of weaknesses, 7PK effectively unifies its perspective. 699 relies heavily on categories, with many different perspectives, to support different types of users. 1000 attempts to achieve a unified perspective, such as the intended omission of all categories and a focus on the core weakness in terms of its behaviors and resources. 1000 tries to omit attacks or consequences, although some consequences are treated as the last link in a chain. It also treats protection mechanism failures (CWE-693) as chaining relationships. For example, insufficient input validation (CWE-20) can lead to many issues such as SQL injection (CWE-89) and XSS (CWE-79), so in CWE-1000, these are chaining relationships instead of parent/child relationships. This approach also has the side effect of allowing modeling of other protection mechanism failures, such as insufficient output sanitization (CWE-116), which is a significant factor in SQL injection and XSS.