Former CISA Secure by Design chiefs launch Software Safety Institute
Zabierek and Lord want to give software buyers what car buyers take for granted: independent, comparable safety data on the products they're purchasing.
TL;DR
Bob Lord and Lauren Zabierek, who led CISA's Secure by Design initiative and secured pledges from roughly 300 software manufacturers, launched the Software Safety Institute on Monday. The nonprofit aims to make software safety measurable and visible, creating something analogous to crash-test ratings for the procurement market. Zabierek serves as CEO; Lord is chief strategy officer. The founders had wanted an independent entity to track how Secure by Design principles actually play out in the market even while they were still at CISA, they told Nextgov/FCW.
The framing choice is deliberate. The pair didn't call it the Software Security Institute. "Security is the property of the software, but safety is the outcome," Zabierek told Nextgov/FCW.
The metaphor they reach for is automotive. A car buyer can look up how a vehicle performed in a crash test. A hospital buying software has no comparable data to distinguish between two vendors. The institute wants to build that missing layer, evidence about product failures that buyers and policymakers can actually use.
Lord arrived at CISA after a stint as CISO of the Democratic National Committee. Then-Director Jen Easterly recruited him to work the problem from the manufacturer's side rather than the buyer's. The core idea: if manufacturers stopped shipping hardware with default passwords, buyers wouldn't need to worry about changing them. Nearly 70 companies signed CISA's voluntary Secure by Design pledge when it launched in May 2024. By the time Lord and Zabierek resigned in April 2025, roughly 300 had signed.
But even at the agency, the two saw a gap. They wanted someone outside government "to take an independent view of how secure by design is actually playing out," Zabierek said. Now, outside CISA, they can pursue that independent assessment without the constraints of agency processes.
Early engagements are already underway. Zabierek has proposed to Massachusetts officials an approach using state-collected breach reports to identify recurring product failures. Because states buy software at scale, pattern detection across incidents could equip procurement officers with concrete vendor-evaluation criteria.
CISA acting director Bridget Bean said at the time of their departure that the agency's commitment to Secure by Design principles "remains steadfast." But the independent tracking function the founders wanted was never built inside the agency. Now they're building it outside.
Published ·Deep Fathom