Thirty years ago this week, a hacker writing as Aleph One published "Smashing the Stack for Fun and Profit" in Phrack. The article showed readers how to hijack a program by feeding it more data than it could safely hold, and it brought buffer-overflow exploits to a mass audience.
The flaw it described is still showing up in shipping products today.
That stubborn fact sits at the center of the Software Safety Institute (SSI), a new public-interest nonprofit launched Monday, November 9, by Lauren Zabierek and Bob Lord. The two started and co-led U.S. CISA's Secure by Design initiative under the Biden administration. They persuaded hundreds of technology providers to pledge to build safer products. Now, they're taking that work outside government.
The Secure by Design pledge started small. Nearly 70 companies signed CISA's voluntary commitment in May 2024. By the time Zabierek and Lord announced their resignations in April 2025, roughly 300 had signed on.
The pledge flipped a long-standing assumption. Instead of asking customers to fix vulnerabilities after installation, it asked manufacturers to resolve issues inside the product before it ships. If a vendor stops shipping hardware with simple default passwords, buyers never have to remember to change them.
SSI picks up where the pledge left off. According to the founders, the Institute aims to:
Measure the state of software safety and make it visible
Shift market forces and policy incentives so manufacturers have reason to build safer products
Shape public norms and expectations about what software makers owe their customers
Zabierek serves as CEO. Lord is chief strategy officer. SSI is a 501(c)(3) based in Boston, Massachusetts.
The name is deliberate. In an interview with Nextgov/FCW ahead of the launch, Zabierek explained the distinction: security describes the software, but safety describes what happens to the people who depend on it.
Her launch statement makes the case with an analogy every security leader has heard, and one few vendors like:
"For years, we've told people that cybersecurity is their job: use better passwords, spot the phishing email, patch faster. Meanwhile, the products themselves ship with defects we've known how to prevent for decades. Cars, airplanes, and medicines didn't become safer because their users got more careful. They became safer because manufacturers were held responsible for what they built."
The founders pointed to a concrete gap. A car buyer can look up how a model performed in a crash test. A hospital choosing between two software vendors has almost nothing comparable to go on.
"This isn't a technical problem we can't solve," Zabierek said. "It's a question of incentives and public policy."
Lord's path to CISA began in frustration. As CISO of the Democratic National Committee, he spent years defending an organization running products that shipped with known flaws or unsafe settings. When he told then-Director Jen Easterly about it, she asked him to come work on the problem from the manufacturer's side.
He frames memory safety as the clearest example of what's gone wrong:
"Coding errors related to memory safety were well understood thirty years ago, and they still routinely show up in products shipping today. That isn't because engineers don't know how to prevent them. It's because the incentives reward shipping fast and leaving the cleanup to customers."
AI has made the backlog impossible to ignore. Last month, researchers used AI to uncover critical flaws in PHP, the language behind a large share of the world's websites. Lord told Nextgov/FCW that tools like these are surfacing "30 years of deferred safety decisions."
The typical industry response, he noted, is to focus on how quickly customers apply fixes. He'd rather ask why there are so many fixes to apply in the first place.
To mark the Aleph One anniversary on November 8, SSI released a narrative podcast exploring why memory safety flaws remain so common and so damaging.
SSI launches with a board that reads like a roll call of the past administration's cyber leadership:
Jen Easterly, former CISA Director and now CEO of RSAC
Camille Stewart Gloster, CEO of CAS Strategies and former Deputy National Cyber Director for Technology and Ecosystem Security
Eric Goldstein, Managing Vice President and Head of Cyber Risk at Capital One, and former CISA cybersecurity chief
Laura Manley, Executive Director of the Shorenstein Center at Harvard Kennedy School
Zabierek and Lord
Easterly made the case for why this work needs to live outside government:
"When I led the Cybersecurity and Infrastructure Security Agency, I said we don't have a cybersecurity problem so much as a software quality problem. That's still true. Government helped start this conversation, but lasting change needs independent, sustained pressure from outside government."
Stewart Gloster focused on who pays the price when software fails:
"Rural hospitals, small water utilities, school districts, and the families who rely on them have the least room to absorb a disruption, and the least say over how the products they depend on are built. Holding manufacturers responsible is how you protect the people who could never have prevented the problem in the first place."
The founders aren't waiting for legislation. Engagement is already underway on several fronts.
State procurement – Zabierek has proposed to Massachusetts officials that the state analyze its own breach reports to find recurring product failures. Because states buy software at scale, patterns across incidents could give procurement teams specific criteria for evaluating vendors before signing future contracts.
Federal contracting – Lord sees a similar opportunity in U.S. government acquisition.
Europe as a test case – SSI plans to study the EU's Cyber Resilience Act, which now requires manufacturers to report serious security incidents and actively exploited flaws.
Policy input – SSI has already published several consultation responses. These include an October comment to NIST arguing that the National Vulnerability Database's core problem is accountability for CVE record quality, not processing capacity. It also submitted a response to ENISA's Security by Design playbook calling for outcome-based principles and independent verification.
Lord told Nextgov/FCW that outside government, he and Zabierek can convene researchers and companies without the formal processes that bind a federal agency. Even while at CISA, Zabierek said, they wanted an independent body to assess how Secure by Design was actually playing out.
SSI's launch lands at a moment when the cost of "ship now, patch later" has never been more visible.
In just the past month, attackers have forced refrigeration controllers across Europe into defrost mode, and the vendor acknowledged that many of the affected units were legacy products it no longer updated. AI-assisted discovery is surfacing decades-old bugs faster than defenders can patch them. And CISA's own Secure by Design program no longer has the two people who built it.
For CISOs, the Institute's thesis is a familiar frustration given institutional form. Security teams have spent years absorbing the downstream cost of upstream decisions they had no say in. SSI is betting that evidence, procurement pressure, and public expectations can do what voluntary pledges alone could not: make software makers own the safety of what they ship.
Whether an independent nonprofit can generate that pressure without regulatory teeth is the open question. But Zabierek and Lord have already proven they can bring hundreds of vendors to the table. Now, they want to measure what those vendors actually deliver.
For more information, visit the Software Safety Institute at https://softwaresafety.org.