Accident Investigations

Until 1967, no US agency had the sole job of investigating transportation accidents and recommending fixes. Then the National Transportation Safety Board opened, with its own staff.

When a plane goes down, the NTSB pulls the wreckage, reads the black box, and publishes findings the industry learns from, independent of the airline and the regulator.

The Cyber Safety Review Board was meant to be the software version. Part-time executives, no staff, no subpoena power, no mandate to study patterns: three reports in three years. The model works. We never built it.

Discussion prompts

• If an independent investigator looked at the last major breach your product was connected to, what would it conclude about your product's role?
• Who is responsible for determining the root cause of a security defect that led to a customer breach?
• If the same defect class shows up in your product again, what would be different about how you respond?