The Victims

The Victims are the customers, operators, and bystanders who pay the price for insecure software.

They are hospitals that cancel procedures. Schools that shut down. Small businesses that close. Individuals whose data is exposed, identities stolen, finances drained.

Victims rarely made the choices that led to their harm. They relied on software manufacturers to build products that were safe. When those products fail, the victims bear costs they didn't create.

Discussion prompts

• Who are the victims when your software has a security defect — and do they have a voice in your process?
• What downstream harms from your product's security weaknesses have you investigated? What changed as a result?
• When your product has an exploited security defect, who in your organization is accountable for the harm it causes to customers?