CISA’s former Secure by Design chiefs launch their own software safety organization

In November 1996, a hacker writing as Aleph One showed readers of Phrack, an underground magazine for hackers, how an attacker could take control of a program simply by sending it more data than it could safely store. The extra data could spill into another part of the program’s memory and change which instructions it followed next, letting an attacker run code of their choosing.

The article, “Smashing the Stack for Fun and Profit,” walked readers through what’s known as a buffer overflow vulnerability. It turned 30 on Sunday, but the kind of flaw it described still turns up in software today.

That phenomenon — why manufacturers still ship products with defects they’ve long known how to prevent — is one of the questions behind the Software Safety Institute, a nonprofit launched Monday by Bob Lord and Lauren Zabierek. The two led the Cybersecurity and Infrastructure Security Agency’s Secure by Design initiative under the Biden administration, persuading hundreds of technology providers to pledge to build safer products.

Now they want to build upon that work, the founders told Nextgov/FCW in an interview ahead of the launch. Zabierek serves as the institute’s CEO and Lord is its chief strategy officer.

The pair, broadly, are seeking to make software safety measurable and visible, strengthen incentives for manufacturers to build safer products and use evidence about product failures to inform buyers and policymakers.

Even while working at CISA, the two wanted someone outside the agency to “take an independent view of how secure by design is actually playing out,” Zabierek said.

A car buyer, for example, can look up how a model performed in a crash test, they noted. Yet a hospital buying software has little comparable information to help it choose between two vendors. 

That distinction is why the pair put “safety” in the institute’s name. As Zabierek put it, “security is the property of the software, but safety is the outcome.”

Lord came to CISA after a call from then-Director Jen Easterly. He had left his job as chief information security officer at the Democratic National Committee and told Easterly how frustrating it had been to defend an organization using products that came with known flaws or unsafe settings. She asked him to join the agency and work on the problem from the manufacturer’s side.

Instead of burdening buyers with fixing vulnerabilities after installation, CISA focused on having manufacturers resolve issues directly within the product. For instance, if a manufacturer stopped delivering hardware configured with simple default passwords, buyers would no longer need to worry about changing them manually.

Nearly 70 companies signed CISA’s voluntary pledge in May 2024. By the time Zabierek and Lord announced their resignations in April 2025, about 300 had signed.

Lord said CISA could get manufacturers’ attention in a way few institutions could. But outside the government, he and Zabierek can bring researchers and companies together without the formal processes required by the agency. 

At the core of the effort is a question about how the global economy builds and ships insecure technology products, and why society hasn’t developed the cultural and legal incentives to prevent the same flaws from propagating. 

Engagements with stakeholders have already started. Zabierek has proposed an approach to officials in Massachusetts: analyzing state-collected breach reports to identify recurring product failures. Because states purchase software extensively, detecting patterns across multiple incidents could provide state buyers with specific criteria to evaluate vendors before completing future acquisitions.

Lord sees a similar opportunity in the U.S. federal contracting space. They also plan to study what happens in Europe, where the Cyber Resilience Act now requires manufacturers to report serious security incidents and flaws that hackers are actively exploiting.

Easterly is joining the institute’s board alongside former Deputy National Cyber Director Camille Stewart Gloster, former CISA cybersecurity chief Eric Goldstein and Laura Manley, executive director of Harvard Kennedy School’s Shorenstein Center.

“When I led the Cybersecurity and Infrastructure Security Agency, I said ‘we don’t have a cybersecurity problem so much as a software quality problem.’ That’s still true,” Easterly said. “Government helped start this conversation, but lasting change needs independent, sustained pressure from outside government.”

“When software fails, the harm doesn’t land evenly. Rural hospitals, small water utilities, school districts, and the families who rely on them have the least room to absorb a disruption, and the least say over how the products they depend on are built,” said Gloster. “Holding manufacturers responsible is how you protect the people who could never have prevented the problem in the first place.”

Artificial intelligence has given the work new urgency, the founders said. Last month, researchers used AI to find critical flaws in PHP, software that helps run websites worldwide. Lord described what those tools are exposing as “30 years of deferred safety decisions.” 

The usual response, he said, has been to focus on how quickly customers install a fix.

“We blame [consumers] for not having deployed the security updates fast enough without asking why on earth are there so many security updates?” he said.