The concept of vulnerability has held a central place in research ethics guidance since its introduction in the United States Belmont Report in 1979. It signals mindfulness for researchers and research ethics boards to the possibility that some participants may be at higher risk of harm or wrong. Despite its important intended purpose and widespread use, there is considerable disagreement in the scholarly literature about the meaning and delineation of vulnerability, stemming from a perceived lack of guidance within research ethics standards. The aim of this study was to assess the concept of vulnerability as it is employed in major national and international research ethics policies and guidelines. We conducted an in-depth analysis of 11 (five national and six international) research ethics policies and guidelines, exploring their discussions of the definition, application, normative justification and implications of vulnerability. Few policies and guidelines explicitly defined vulnerability, instead relying on implicit assumptions and the delineation of vulnerable groups and sources of vulnerability. On the whole, we found considerable richness in the content on vulnerability across policies, but note that this relies heavily on the structure imposed on the data through our analysis. Our results underscore a need for policymakers to revisit the guidance on vulnerability in research ethics, and we propose that a process of stakeholder engagement would well-support this effort.