Lauren Zabierek and Bob Lord, who ran the Cybersecurity and Infrastructure Security Agency's Secure by Design program under the Biden administration, launched a nonprofit Monday to measure how safely software makers build their products, Nextgov/FCW reported. For organizations that buy software, the Software Safety Institute could become an outside source of evidence on which vendors keep shipping preventable defects.
What Happened
Zabierek is the institute's chief executive and Lord its chief strategy officer. The board includes former CISA Director Jen Easterly, former Deputy National Cyber Director Camille Stewart Gloster, former CISA cybersecurity chief Eric Goldstein and Laura Manley, executive director of Harvard Kennedy School's Shorenstein Center.
According to Nextgov/FCW, the group wants to make software safety measurable and visible, strengthen manufacturers' incentives to build safer products and use evidence about product failures to inform buyers and policymakers. One of the questions behind the institute is why manufacturers still ship products with defects they have long known how to prevent, Nextgov/FCW reported.
Why It Matters
CISA's program relied on persuasion. Nearly 70 companies signed its voluntary pledge in May 2024, and about 300 had signed by April 2025, when Zabierek and Lord announced their resignations, Nextgov/FCW reported. The new institute shifts the focus from promises to evidence.
Zabierek suggested Massachusetts analyze the breach reports the state already collects to spot recurring product failures, which would give state buyers concrete criteria for judging vendors. Lord sees a similar opening in federal contracting. If buyers adopt such criteria, vendor safety records could start to count in procurement decisions and contract terms that executives negotiate.
The founders say artificial intelligence adds urgency. Lord described the critical PHP flaws that researchers found with AI tools last month as "30 years of deferred safety decisions," and questioned the habit of judging customers by how fast they install updates. PHP is a programming language that runs a large share of the world's websites. The Primary Wire reported in October on fixes for two of those flaws, citing Reuters.
Context
The founders plan to study the European Union's Cyber Resilience Act, which goes further than a pledge. Since Sept. 11, 2026, it has required manufacturers to report actively exploited vulnerabilities and severe incidents in their products, with an early warning due within 24 hours, according to the European Commission.
What to Watch
Watch whether Massachusetts or other states begin mining breach reports for procurement criteria, whether federal contracting rules follow, and who funds the institute; Nextgov/FCW's report did not say.
