CISA’s former Secure by Design chiefs launch their own software safety organization

* Lauren Zabierek and Bob Lord led the CISA’s Secure by Design initiative under the Biden administration.
* A hacker showed a buffer overflow vulnerability in 1996 in an article titled “Smashing the Stack for Fun and Profit.”
* The founders established the Software Safety Institute in response to the question of why manufacturers still ship defective products.
* The CISA initiative persuaded hundreds of technology providers to pledge to build safer products.
* The group seeks to make software safety measurable and visible, strengthen manufacturer incentives, and use product failures for buyer/policymaker guidance.
* Safety is defined as the outcome, while security is the property of the software.
* CISA focused on manufacturers resolving issues internally rather than burdening buyers with fixes after installation.
* Nearly 300 companies signed CISA’s voluntary pledge in May 2024; approximately 300 signed by April 2025.
* Zabierek serves as the institute’s CEO, and Lord is its chief strategy officer.
* Stakeholder engagements include analyzing state-collected breach reports to identify recurring product failures and studying European regulations like the Cyber Resilience Act.

The narrative highlights a tension between government-led mandates and the need for independent, sustained pressure to drive systemic change in technology production. The shift from government-focused mitigation (CISA) to an independent, market-driven accountability mechanism (the Institute) reveals a recognition that formal regulatory frameworks are insufficient for addressing widespread, latent flaws embedded in products. The focus on "safety" as the outcome—rather than just security as a feature—points toward a deeper concern about societal impact and the uneven distribution of risk across different user groups, such as rural entities.
The engagement with stakeholders, proposing analysis of state breach reports and examining international regulatory shifts, suggests a strategy to translate technical vulnerabilities into actionable economic and legal incentives. The use of AI to reveal "30 years of deferred safety decisions" introduces an urgency rooted in retrospective accountability, suggesting that the pace of technological advancement is outpacing the development of necessary social and legal guardrails. This indicates a pattern where established structures (government agencies) initiate change but require external momentum to achieve enduring shifts in manufacturing culture.
The implications touch upon agency: when harm is distributed unevenly—affecting vulnerable populations like small utilities or rural hospitals—the lack of transparent, comparable product safety metrics exacerbates existing societal inequalities. The pursuit of independent analysis attempts to bridge the gap between technical defect identification and real-world consequence, demanding an inquiry into why economic incentives have failed to prioritize preventative action over reactive patching.
Bridge questions: How can the insights gathered from state breach reports be effectively integrated into cross-sector regulatory frameworks? What mechanisms are necessary to ensure that manufacturer incentives align with long-term safety outcomes rather than short-term compliance? If AI reveals deferred safety decisions, what independent oversight structures are required now to prevent the next generation of technical debt from becoming irreversible societal harm?