About SSI
The Software Safety Institute (SSI) is a public-interest nonprofit working to reduce preventable harm from software. SSI publishes research and analysis on software safety and works to move accountability upstream, to the companies that design and ship software. It is a 501(c)(3) organization.
Mission
The Software Safety Institute works to reduce preventable harm from software by changing the systems, incentives, and practices that shape how software is designed, built, deployed, and maintained.
Vision
SSI envisions a world where preventable harm from unsafe and insecure software is rare, bounded, and no longer accepted as an inevitable cost borne by the people and institutions that depend on it.
Why SSI exists
SSI exists because software has become foundational to modern life—shaping healthcare delivery, energy systems, financial markets, democratic institutions, and everyday consumer products—yet the systems for designing, building, deploying, maintaining, and evaluating software have not evolved to match the scale of its consequences.
Food, medicine, aviation, and cars became safer when institutions like the FDA, FAA, and NHTSA made risk visible and set safety expectations. Software has no equivalent. SSI was created to help fill that gap.
Origins
SSI’s founders, Lauren Zabierek and Bob Lord, started and co-led the Secure by Design initiative at the Cybersecurity and Infrastructure Security Agency (CISA). The initiative called on software manufacturers to take ownership of their customers’ security outcomes, embrace radical transparency and accountability, and lead from the top. Its joint guidance, Shifting the Balance of Cybersecurity Risk (opens in a new tab), was co-sealed by 17 U.S. and international partners, and as of November 2026, 393 companies (opens in a new tab) have signed the Secure by Design Pledge. They left CISA in 2025 and founded SSI to continue that work outside government. SSI is independent of CISA and the U.S. government.
Since then, we have built on that work by looking outside the software industry to understand how to make software safer for the people who depend on it. The automotive, aviation, and pharmaceutical industries became measurably safer over decades, for the people they serve and for the public around them. We believe software can too. Unsafe software is not a technical inevitability. It is the result of market incentives and public policy, and both can change.
Our approach
SSI treats software safety as a systems problem, not a narrow technical one. It is also a “slow burn” problem: harm builds up over time, there is no single villain or pattern to disrupt, no one intervention can fix it, and even the right efforts take time to show results. Systems problems require systems solutions.
Most attention in this space goes, almost by reflex, to the “right-of-boom” work of managing the consequences of insecure and unsafe software, such as advice to help people stay safe online, threat intelligence sharing, workforce development, and security products that compensate for unsafe software after it ships. That work is necessary. SSI focuses instead on what comes before it: the incentives that produce software that cannot withstand attack and is indifferent to how it is deployed, foreseeable risks, preventable failures, and situations where the costs of software failure are routinely pushed onto people, communities, and institutions that did not meaningfully choose or benefit from those risks.
Nobody knows how to make perfectly safe software. That may be the goal someday, but today the software ecosystem lacks the technical tools, processes, and incentives to reach it. Software can, however, be made substantially safer than it is today, with outsized benefits for customers and the public.
Independence and funding
SSI is a public-interest safety institution. Our credibility depends on independence and on the public being able to trust that our findings are guided by evidence, not by who funds our work. SSI is a 501(c)(3) nonprofit funded by grants and donations.
Our commitments:
- We publish what we find. Funders never approve our work or control our conclusions.
- We do not accept funding conditioned on our findings or positions, or that requires us to advocate for a specific company, technology, or product.
- Funding never buys an endorsement or certification from SSI.
- We disclose funding from software manufacturers, AI companies, and security product companies alongside any SSI work that concerns the funder.
Drawing: U.S. Patent 11,820,383 · Figure: FIG. 12