“A secure laptop will cost $10k!”

Reality: The cost is already being paid, just not by the manufacturer.

Customers buy tools, staff teams, and absorb incidents to compensate for defects they did not create. Fixing a defect class upstream costs once. Mitigating it downstream costs once per customer, every year (see E-05).

The question isn't what secure software costs. It's why the expensive version is the one we chose.

Discussion prompts

• Add up what your customers spend compensating for defects in your product. How does that compare to fixing the defect class?
• Which of your security costs would disappear if your suppliers did this work upstream?
• What would change if your customers could bill you for their remediation costs?