Software Safety Institute Launches to Reduce Preventable Harm from Insecure Software

New public-interest nonprofit will advance research, evidence, and policy to make software safety a measurable priority

BOSTON, Nov. 09, 2026 (GLOBE NEWSWIRE) -- The Software Safety Institute (SSI), a new independent public-interest nonprofit, today announced its launch to address the systemic conditions that allow preventable harm from unsafe and insecure software to persist.

Software underpins essential services, critical infrastructure, businesses, and daily life. Yet responsibility for its safety is often fragmented, and the people and institutions that depend on it bear the costs of insecure software. SSI will work to change the systems, incentives, and practices that shape how software is designed, built, deployed, and maintained.

“For years we’ve told people that cybersecurity is their job: use better passwords, spot the phishing email, patch faster. Meanwhile, the products themselves ship with defects we’ve known how to prevent for decades,” said Lauren Zabierek, co-founder and CEO of the Software Safety Institute. “Cars, airplanes, and medicines didn’t become safer because their users got more careful. They became safer because manufacturers were held responsible for what they built. Software is now part of what people need to live safely, and it should be held to the same standard. This isn’t a technical problem we can’t solve. It’s a question of incentives and public policy.”

SSI will advance software safety through independent research and analysis, public education, policy and accountability frameworks, and collaboration across government, industry, academia, and civil society. Its work will produce evidence that helps decision-makers assess software safety and encourages safer practices across the ecosystem.

Yesterday, November 8, marked the 30th anniversary of Aleph One’s “Smashing the Stack for Fun and Profit,” the landmark 1996 article that brought buffer-overflow exploits to a wide audience. On that anniversary, SSI released The Bug We Let Live, a narrative podcast about memory safety and why flaws of the same kind remain common and damaging in software. Today, November 9, SSI launches to take up the next question: what will it take to change the incentives that allow preventable software defects to persist?

“Coding errors related to memory safety were well understood thirty years ago, and they still routinely show up in products shipping today,” said Bob Lord, SSI co-founder and Chief Strategy Officer. “That isn’t because engineers don’t know how to prevent them. It’s because the incentives reward shipping fast and leaving the cleanup to customers. We want to change what manufacturers are expected to deliver, and give policymakers and buyers the evidence to hold them to it.”

SSI’s board of directors includes Zabierek; Lord; Jen Easterly, CEO of RSAC; Camille Stewart Gloster, CEO of CAS Strategies; Eric Goldstein, Managing Vice President and Head of Cyber Risk at Capital One; and Laura Manley, Executive Director of the Shorenstein Center at the Harvard Kennedy School.

“When software fails, the harm doesn’t land evenly. Rural hospitals, small water utilities, school districts, and the families who rely on them have the least room to absorb a disruption, and the least say over how the products they depend on are built,” said Camille Stewart Gloster, a founding director of SSI and former Deputy National Cyber Director for Technology and Ecosystem Security. “Holding manufacturers responsible is how you protect the people who could never have prevented the problem in the first place.”

SSI envisions a world where preventable harm from unsafe and insecure software is rare, bounded, and no longer accepted as an inevitable cost borne by the people and institutions that depend on it.

“When I led the Cybersecurity and Infrastructure Security Agency, I said we don’t have a cybersecurity problem so much as a software quality problem. That’s still true,” said Easterly. “Government helped start this conversation, but lasting change needs independent, sustained pressure from outside government.”

SSI is a 501(c)(3) nonprofit organization. Learn more at softwaresafety.org.

About the Software Safety Institute
The Software Safety Institute is an independent 501(c)(3) nonprofit dedicated to changing the systems, incentives, and practices that shape how software is designed, built, and governed. SSI conducts research, develops policy proposals, and educates the public so that preventable harm from insecure software becomes rare. SSI was founded by Lauren Zabierek and Bob Lord, who started and co-led CISA’s Secure by Design initiative.

Media Contact:
Ciara DiVita for SSI
ciara@aspironinfluence.com | 860.387.3752