CISA's Secure by Design pledge asked software vendors to do something radical: take responsibility for the security of the products they ship. Not document the risks and hand them to the customer. Not sell the secure version as the premium tier. Build it in from the start.
A lot of vendors signed. The pledge asked for concrete commitments — things like eliminating default passwords, publishing vulnerability disclosure policies, and working toward reducing entire classes of vulnerabilities rather than whack-a-moling individual bugs. On paper, it was the most meaningful shift in the vendor-customer security relationship in years.
So where are we?
What the pledge got right
The core idea is sound, and it's worth saying plainly: the customer should not be the QA department for a vendor's security. For decades, the industry's unspoken deal was that buyers would configure, patch, monitor, and generally babysit products into something resembling secure — and vendors would sell them the tools to do the babysitting. Secure by Design flips that deal. The radical part isn't the technology. It's the accountability.
The pledge also did something subtle and important: it gave security-conscious buyers language. Before the pledge, asking a vendor "what are you doing about entire classes of vulnerabilities?" got you a blank stare and a brochure. Now there's a shared vocabulary. Procurement teams can point at the pledge and ask where a vendor stands. That's real progress, even if it's boring progress.
Where it gets wobbly
Here's the uncomfortable part. A pledge is not a regulation. There's no enforcement mechanism, no audit, no penalty for signing the thing and then quietly doing nothing. The vendors who were already serious about security signed it and kept doing what they were doing. The vendors who weren't... also signed it, in many cases. A signature is cheap. Secure defaults are expensive.
And there's a deeper structural problem the pledge can't fix on its own: the market doesn't reliably reward secure products. Buyers say they care about security, and then they buy on features and price, like they always have. Until procurement genuinely penalizes insecure products — until "we can't buy this because your secure-by-design posture is weak" is a sentence someone actually says in a buying decision — the pledge runs on goodwill. Goodwill is a fine fuel for a pilot program. It's a terrible fuel for an industry transformation.
The other wobble: "secure by design" is easy to say and genuinely hard to define at the margins. Eliminating default passwords? Clear. Publishing a disclosure policy? Clear. But "reducing classes of vulnerabilities" is a spectrum, and every vendor gets to grade its own homework. Without independent verification, we're back to trusting the brochure — just a nicer brochure with better vocabulary.
What it means for buyers
If you're evaluating vendors, the pledge is useful but insufficient. Here's how I'd use it:
First, treat a signature as a starting point, not a credential. Ask what specifically changed in their development process since they signed. If the answer is vague, the signature is decorative.
Second, ask about the classes of vulnerabilities, not the count of CVEs patched. A vendor that eliminated SQL injection across their product line through parameterized queries and framework guardrails has done something real. A vendor that patched forty SQL injection CVEs last year has done something too — something that suggests the first thing never happened.
Third, look at the defaults. This is the fastest test in the book. Install the product the way a tired admin at 11 PM would install it — next, next, finish — and see what you get. If it's secure, they mean it. If it takes a forty-page hardening guide to make it safe, the pledge is a poster on the wall.
The pledge moved the conversation. That's not nothing. But conversations don't patch vulnerabilities, and signatures don't change defaults. The idea is right. The follow-through is still an open question — and it's the buyers, not CISA, who get to decide whether it was real.
The vendors are waiting to see if we meant it. We should probably decide.