Passing the Buck

With 99% of US businesses classified as small or mid-sized, expecting them to absorb the full cost of insecure software is not a plan.

But when SMBs can't manage that risk, it doesn't disappear. It spills over into disrupted supply chains, breached data, financial losses, and public-sector emergency response.

That residual risk compounds across sectors, borders, and time — threatening national security, economic stability, and public trust. Pushing the cost of insecure design onto the most vulnerable actors is the result of multiple, interlinking incentives.

Discussion prompts

• When an organization has a security incident because of a product defect, who ultimately absorbs the cost?
• What downstream effects have you seen when a manufacturer's insecurity hit your supply chain?
• How should responsibility for the costs of insecure software be redistributed to improve customer security outcomes?