Launched November 9, 2026. Read why we started SSI.
Software Safety Institute
Software runs the world. It should be safe.
The Software Safety Institute (SSI) is a public-interest nonprofit working to reduce preventable harm from software.
Founded by Lauren Zabierek and Bob Lord, who started and co-led CISA’s Secure by Design initiative.
Software failures don’t stay inside computers.
Software helps deliver healthcare. It moves money. It keeps water flowing, schools operating, businesses running, and public services available. When that software is insecure, the consequences travel outward.
A vulnerability can become a cancelled surgery. A disrupted school day. A small business unable to operate. A family whose personal information can never be made private again. A community that loses access to an essential service.
Software insecurity is ultimately a problem of human safety.
Software makers are missing from the picture.
Most security advice is aimed at the people who run software: patch faster, monitor more, train your staff. Far less is asked of the companies that make it. Software safety starts with them: preventing harm means changing how software is designed, built, and brought to market.
Software is built and shipped like any other manufactured product, and vulnerabilities ship with it.
Featured publications
- Consultation response
Vulnerability Data Needs Accountability at the Source
A response to NIST’s request for information on modernizing the National Vulnerability Database, arguing that the problem is accountability for the quality of CVE records, not processing capacity, and recommending structural substitutions rather than new NVD capabilities.
- Commentary
AI Safety Needs Public Institutions, Not Just Industry Consensus
In an NSI expert roundup, Lauren Zabierek argues that durable AI safety requires enforceable expectations, oversight, and institutions that collect evidence and learn from failures.
- Consultation response
Making Secure by Design Measurable and Accountable
A response to ENISA’s Security by Design and Default Playbook (v0.4) asking why preventable defects persist despite decades of guidance, and urging outcome-based principles, independent verification, and field feedback loops.
- Testimony
Small Businesses Should Not Bear the Costs of Unsafe Software
Insecure software design imposes costs small businesses cannot bear. The testimony calls for defect transparency, independent testing, institutional learning, and manufacturer accountability.
From the blog
Introducing the Software Safety Institute
Now is the time to look upstream and build software that is secure by design.
The Software Safety Project
Help build the safety infrastructure software still lacks.
Preventable defects are treated as inevitable. They are not.
Building software safety will take researchers, policymakers, technologists, funders, companies, and the public. Support SSI’s work, partner with us, or bring us a problem we should be working on.