Own Customers’ Security

Who owns your customers' security outcomes? Secure-by-design products are built to perform well in the real world — not just in ideal conditions.

This requires designing components and development processes that raise the cost for attackers and lower the burden on customers:

Study how customers actually deploy and use your product

Turn hardening guides into loosening guides — strong defaults come first

Track and eliminate recurring classes of coding error

Discussion prompts

• How does your team currently define and measure customer security outcomes?
• Where in your product does the security burden fall on the customer rather than the manufacturer?
• What would it look like to turn your hardening guide into a loosening guide?