Is CISA's Secure by Design Pledge Toothless?

At RSA 2024, major vendors signed CISA's voluntary 'Secure by Design' pledge committing to seven security objectives—multi-factor authentication, default password elimination, reducing classes of vulnerabilities, timely patching, vulnerability disclosure policies, CVE handling, and evidence of intrusions—to encourage better baseline product security. Industry voices quoted in the article frame the pledge as an economic and cultural lever rather than a regulatory instrument, and Claroty data is used to illustrate why focusing on exploitable assets and default credentials can be more impactful than patching every high-CVSS finding.