Despite broad agreement that the vulnerable have a claim to special protection, defining vulnerable persons or populations has proved more difficult than we would like. This is a theoretical as well as a practical problem, as it hinders both convincing justifications for this claim and the practical application of required protections. In this paper, I review consent‐based, harm‐based, and comprehensive definitions of vulnerability in healthcare and research with human subjects. Although current definitions are subject to critique, their underlying assumptions may be complementary. I propose that we should define vulnerability in research and healthcare as an identifiably increased likelihood of incurring additional or greater wrong. In order to identify the vulnerable, as well as the type of protection that they need, this definition requires that we start from the sorts of wrongs likely to occur and from identifiable increments in the likelihood, or to the likely degree, that these wrongs will occur. It is limited but appropriately so, as it only applies to special protection, not to any protection to which we have a valid claim. Using this definition would clarify that the normative force of claims for special protection does not rest with vulnerability itself, but with pre‐existing claims when these are more likely to be denied. Such a clarification could help those who carry responsibility for the protection of vulnerable populations, such as Institutional Review Boards, to define the sort of protection required in a more targeted and effective manner.