The Power of the Purse: How to Ensure Security by Design

This commentary argues that CISA’s Secure by Design pledge is ineffective because it is voluntary, urging the U.S. to mandate its goals (MFA, reducing default passwords, measurable vulnerability reduction, increased patch adoption, vulnerability disclosure policies, transparent reporting, and improved evidence collection) with audits and penalties; it contrasts this stance with successful regulatory models such as the EU’s USB-C requirement and California’s ZEV standards, and briefly promotes an upcoming Dark Reading virtual event.