Specification failure happens when a system satisfies its assigned technical target but still fails the real-world purpose it was meant to serve. In security, this often means the metric is too narrow: an access control rule may reduce support tickets, a detector may maximize precision, or an automated blocker may reduce alerts, while attackers still get through or legitimate users are harmed. The code works as specified; the specification is wrong.
This matters because many cyber defenses are built around measurable goals such as low false positives, fast response, or high throughput. Adversaries can exploit that gap by staying just under alert thresholds, abusing workflow assumptions, or using behavior that the model was not asked to care about. Defenders reduce specification failure by defining security goals broadly, testing with realistic attack paths, checking subgroup and edge-case effects, keeping audit logs, and using human review for high-impact actions.