The Vendors

The Vendors are the software manufacturers who build and ship the products.

Today, most vendors can externalize the cost of insecure software onto customers and society — through EULAs, disclaimers, and the absence of legal accountability. This creates a market where the incentive to invest in security is weak.

Some vendors are beginning to change. They publish roadmaps to eliminate defect classes, bring developers with security expertise in early, and treat customer safety as a core metric.

Discussion prompts

• What accountability mechanisms exist in your organization when a security defect causes customer harm?
• What would change about your product development if software manufacturers bore the same legal liability for defects as manufacturers in other industries?
• What separates vendors who lead on security from those who follow — and which category are you in?