Today, we’re launching the Software Safety Institute (SSI), a nonprofit built on a simple idea: software should be secure by design.
The incentives that drive the software industry reward speed to market over customer safety. As a result, the burden of staying safe falls downstream, on the organizations and people least able to carry it. The breaches we read about every day shouldn’t surprise anyone. Much of our software was designed and built to serve goals other than the safety of the people who rely on it.
We believe safety should be built in, not bolted on. Many of the most common security defects have been understood for decades, and whole classes of them could have been prevented through better design choices. Responsibility should rest with those best positioned to prevent harm, which means the makers of software. Other industries, from automobiles to aviation, made this shift. Software can too.
Recent advances in AI-driven defect discovery and exploit development are shining a bright light on decades of deferred decisions. The defects AI is finding aren’t new. They’ve been sitting in shipping code for years, and they belong to the same classes that topped the lists 20 years ago. Security practitioners have known this for a long time. Most of the public hasn’t.
Much of the advice in response asks operators to install updates faster, apply hardening guides, and deploy AI to fight AI. None of that is wrong. But it asks the people downstream to work ever harder to absorb the cost of defects they didn’t create, and that approach can’t keep pace. Lasting progress means fixing the problem where it starts.
At SSI, we’ll work to measure the state of software security, to shift the market forces and policy incentives that shape it, and to raise public expectations of what software makers owe their customers.
We come to this work from different directions. Lauren has spent decades working on national security matters. Bob has built software and, as a CISO, lived with the consequences of insecure products. Together, we co-led CISA’s Secure by Design initiative.
Although SSI is just launching, we’ve been busy. Two pieces of work are worth your time.
Yesterday marked the 30th anniversary of “Smashing the Stack for Fun and Profit (opens in a new tab),” published in Phrack magazine by a hacker known as Aleph One. To mark it, we released the first episode of “The Bug We Let Live (opens in a new tab),” a multi-part audio documentary and the first series of our podcast, The Software Safety Project (opens in a new tab). It explores how memory safety defects have persisted for decades, and what it will take to eliminate them. We spoke with people who have shaped this field, including former NSA Cybersecurity Director Rob Joyce, threat modeling expert Adam Shostack, and security researcher Tarah Wheeler. We even tracked down Aleph One himself to get his take.
We also joined the Institute for Security and Technology’s Nick Leiserson in responding to NIST’s request for information on modernizing the National Vulnerability Database. Our response argues that the core problem isn’t processing capacity but the lack of accountability for record quality at the point records are created, and it recommends four structural changes that put that responsibility with software makers. Read the response.
This work takes funding, and we’re asking for it. SSI is a 501(c)(3), and contributions are tax-deductible. Early support shapes what an organization like ours can take on, and the window to change how software is built is open now. Donate online or by check.
We’re also looking for partners: organizations that buy, build, or study software and want to help measure and raise the standard. And if this post made sense to you, share it. Subscribe to our newsletter (opens in a new tab) and follow us on Bluesky (opens in a new tab) to keep up with what we’re doing.