The Software Safety Institute launched this week to address the systemic issue of manufacturers shipping products with known security defects, according to a recent report by Nextgov.
The nonprofit organization was established by Bob Lord and Lauren Zabierek, former leaders of the Cybersecurity and Infrastructure Security Agency’s Secure by Design initiative. The institute aims to make software safety measurable and visible by strengthening incentives for manufacturers and providing evidence-based data to buyers and policymakers. While the industry has long understood vulnerabilities like buffer overflows, these flaws remain prevalent in modern software. By analyzing breach reports and product failures, the founders seek to shift the burden of security from the consumer to the manufacturer. This approach mirrors safety standards in other sectors, such as automotive crash testing, which provide clear metrics for buyers. With the rise of artificial intelligence, which can rapidly identify decades of deferred safety decisions in code, the institute emphasizes that lasting change requires independent, sustained pressure outside of government. The board includes prominent cybersecurity experts who argue that holding manufacturers accountable is essential to protecting vulnerable entities like rural hospitals and school districts from the consequences of poor software quality.
Source: Nextgov
