Secure by Design: How CISA's software pledge reframed accountability in 2025

For decades, the burden of cybersecurity was placed, almost by default, on the customer. Software vendors shipped products with flaws, and the organizations that bought them were expected to patch, configure, and defend. In 2025, that assumption was finally being questioned at the highest levels. The Cybersecurity and Infrastructure Security Agency's Secure by Design initiative made a simple but radical argument: security is a product quality issue, and the companies that build software, not just the customers who buy it, should be accountable for it. Here is what the initiative meant and why it reframed the entire conversation about who is responsible for security.

Shifting the burden to the builder

Secure by Design rests on a straightforward principle: technology should be engineered to be secure out of the box, not made secure through the heroic effort of users. The initiative challenged the long-standing status quo in which vendors shipped default passwords, enabled unsafe settings, and treated vulnerability patching as an optional extra, then left customers to clean up. CISA's message was that this arrangement was neither sustainable nor fair, and that the most effective way to improve security at scale was to fix the problem where it originates, in the design and development of software itself. It was a reorientation of accountability from the buyer to the builder.

The pledge and the metrics that followed

The initiative took concrete form in a voluntary pledge that software manufacturers were invited to sign, committing to specific practices like eliminating default passwords, making multi-factor authentication a standard option, and reducing classes of common vulnerabilities. By 2025, a growing number of major vendors had signed on, and the pledge had moved from a novelty to a signal of seriousness. Critically, the initiative also pushed for measurement, encouraging the disclosure of security outcomes rather than vague promises. The idea was that accountability requires visibility, and that customers and regulators alike should be able to see whether a vendor's security posture was actually improving.

Why the default settings mattered

One of the initiative's most concrete points concerned defaults. For years, some of the most damaging incidents stemmed not from sophisticated attacks but from default passwords left unchanged, or features shipped enabled that should have been off. Secure by Design argued that a vendor that ships an insecure default, and then tells the customer to change it, has effectively shifted the cost of security onto the least capable party. By 2025, the expectation that vendors ship secure defaults, with multi-factor authentication on by default and dangerous features off, had become a baseline demand rather than a differentiator. It was a small change in engineering practice with enormous downstream effect.

What it meant for the customer's own program

Secure by Design did not let customers off the hook, it changed what their responsibility looked like. The initiative was explicit that a secure-by-design product still requires a secure-by-design organization, and that the buyer retains accountability for configuration, access, and the human layer. But the burden shifted in an important way: organizations could now reasonably expect more from their vendors, and demand better defaults and faster patching as a condition of purchase. Security teams began writing these expectations into procurement, using the pledge and its metrics as a way to distinguish vendors that took security seriously from those that did not. The buying power of customers became a lever for industry-wide improvement.

Where awareness and the human layer fit

Secure by Design is often discussed as a matter of engineering and procurement, but the human layer remains central. Even a secure-by-default product is operated by people, and no amount of good engineering removes the need for a workforce that understands phishing, handles data carefully, and reports incidents promptly. The initiative's emphasis on reducing the burden on users did not eliminate that burden, it simply made the remaining human responsibilities clearer and more manageable. Security awareness training remained the complement to secure design, covering the risks that no default setting can fully address. The two worked together: better products, and better-prepared people.

A change in the industry's center of gravity

The lasting significance of Secure by Design in 2025 was the shift it represented in where responsibility for security lives. For too long, the conversation had treated the customer as the primary defender, expected to absorb the cost of vendors' flaws. The initiative helped move the center of gravity back toward the builders, and in doing so it made security a competitive and reputational issue for software companies, not just a burden for their customers. The organizations that embraced the shift, both the vendors that committed to secure design and the buyers that rewarded it, were the ones pushing the entire ecosystem toward a more defensible baseline. It was, in the end, an argument that security is everyone's job, starting with the people who write the code.