Secure-by-Demand Software

Customer demand can nudge the market toward safer software. Security becomes standard when buyers demand it — just as they demand reliability, performance, and usability.

Ask software manufacturers:

Are your CVEs complete, accurate, and timely?

Do you eliminate entire classes of coding error?

Where do you use memory-unsafe programming languages?

Have you published a VDP?

Reward products that prioritize customer safety and discount those that don't.

Discussion prompts

• How does your organization signal security requirements to software manufacturers you purchase from?
• What questions do you currently ask manufacturers about their security practices during procurement? Do those questions align with the most common attack vectors?
• What would a security scorecard for software procurement look like in your organization?