Research and publications on Software Safety Institutehttps://softwaresafety.org/research/Recent content in Research and publications on Software Safety InstituteHugoen-USFri, 16 Oct 2026 00:00:00 +0000NSI Experts Weigh In: Cybersecurity Awareness Monthhttps://softwaresafety.org/research/cybersecurity-awareness-month-roundup/Fri, 16 Oct 2026 00:00:00 +0000https://softwaresafety.org/research/cybersecurity-awareness-month-roundup/In an NSI expert roundup for Cybersecurity Awareness Month, Lauren Zabierek argues that the month places the burden of security on people with little control over it, and calls for treating software insecurity as a public safety problem.Secure by Demand: Holding EdTech Accountable for K-12 Securityhttps://softwaresafety.org/research/rsac-2026-edtech-panel/Fri, 16 Oct 2026 00:00:00 +0000https://softwaresafety.org/research/rsac-2026-edtech-panel/A panel on the gap between edtech vendors’ security commitments and their actions after the PowerSchool and Canvas breaches, and what collective action by schools and families could look like.Vulnerability Data Needs Accountability at the Sourcehttps://softwaresafety.org/research/nist-nvd-rfi-response/Tue, 13 Oct 2026 00:00:00 +0000https://softwaresafety.org/research/nist-nvd-rfi-response/A response to NIST’s request for information on modernizing the National Vulnerability Database, arguing that the problem is accountability for the quality of CVE records, not processing capacity, and recommending structural substitutions rather than new NVD capabilities.AI Safety Needs Public Institutions, Not Just Industry Consensushttps://softwaresafety.org/research/ai-safety-public-institutions/Tue, 22 Sep 2026 00:00:00 +0000https://softwaresafety.org/research/ai-safety-public-institutions/In an NSI expert roundup, Lauren Zabierek argues that durable AI safety requires enforceable expectations, oversight, and institutions that collect evidence and learn from failures.Preparing Massachusetts for Cyber Disruption of Critical Serviceshttps://softwaresafety.org/research/massachusetts-critical-services-cyber-preparedness/Tue, 09 Jun 2026 00:00:00 +0000https://softwaresafety.org/research/massachusetts-critical-services-cyber-preparedness/Recommendations for coordinating preparedness across water, energy, healthcare, and communications, while reducing the software risks that can cause cascading disruption.A State Strategy for Systemic Cyber Risk in Massachusettshttps://softwaresafety.org/research/massachusetts-systemic-cyber-risk-strategy/Mon, 08 Jun 2026 00:00:00 +0000https://softwaresafety.org/research/massachusetts-systemic-cyber-risk-strategy/A proposed state strategy connecting critical infrastructure resilience with safer software procurement, clear responsibility for systemic cyber risk, and regional learning and coordination.What Massachusetts Breach Data Should Tell Us About Unsafe Softwarehttps://softwaresafety.org/research/massachusetts-breach-data-software-safety/Thu, 14 May 2026 00:00:00 +0000https://softwaresafety.org/research/massachusetts-breach-data-software-safety/A response proposing that Massachusetts breach analysis identify recurring software defects, measure downstream harm, and inform stronger product security requirements.Making Secure by Design Measurable and Accountablehttps://softwaresafety.org/research/enisa-secure-by-design-response/Fri, 01 May 2026 00:00:00 +0000https://softwaresafety.org/research/enisa-secure-by-design-response/A response to ENISA’s Security by Design and Default Playbook (v0.4) asking why preventable defects persist despite decades of guidance, and urging outcome-based principles, independent verification, and field feedback loops.Opinion: Rolling back Colorado's right-to-repair laws will weaken critical infrastructure safetyhttps://softwaresafety.org/research/colorado-right-to-repair-software-safety/Fri, 24 Apr 2026 00:00:00 +0000https://softwaresafety.org/research/colorado-right-to-repair-software-safety/Restricting repair access can slow recovery in critical infrastructure while leaving insecure software design untouched. This op-ed argues for stronger manufacturer accountability.How Cyberattacks on Essential Services Hit Women Harderhttps://softwaresafety.org/research/cyberattacks-essential-services-women/Tue, 07 Apr 2026 00:00:00 +0000https://softwaresafety.org/research/cyberattacks-essential-services-women/Cyber disruptions can intensify women’s work and caregiving responsibilities. This article examines those burdens and calls for cybersecurity policy that measures human harm and reflects how communities recover.Building a Learning System for Software Safety Under the Cyber Resilience Acthttps://softwaresafety.org/research/cyber-resilience-act-guidance-response/Tue, 31 Mar 2026 00:00:00 +0000https://softwaresafety.org/research/cyber-resilience-act-guidance-response/SSI’s response to the Commission’s draft CRA guidance, recommending comparable risk assessments, aggregated vulnerability data, independent testing, and feedback loops into design — plus clearer treatment of open-source dependencies and AI systems.A Cyber Strategy Must Start With Safer Softwarehttps://softwaresafety.org/research/cyber-strategy-safer-software/Thu, 12 Mar 2026 00:00:00 +0000https://softwaresafety.org/research/cyber-strategy-safer-software/Lauren Zabierek contributed to NSI’s expert assessment of the Cyber Strategy for America, arguing that offensive operations cannot compensate for software routinely shipped with preventable defects and unsafe defaults.Small Businesses Should Not Bear the Costs of Unsafe Softwarehttps://softwaresafety.org/research/small-business-software-safety-testimony/Tue, 02 Dec 2025 00:00:00 +0000https://softwaresafety.org/research/small-business-software-safety-testimony/Insecure software design imposes costs small businesses cannot bear. The testimony calls for defect transparency, independent testing, institutional learning, and manufacturer accountability.