Will CISA's Secure by Design pledge be a catalyst for better software security?

CISA used the RSA Conference to secure commitments from 68 major software vendors to its Secure by Design pledge, aiming within a year to expand MFA, reduce default passwords, cut common vulnerability classes, increase patch adoption, publish safe VDPs, issue timely CVEs with accurate CWE/CPE data, and improve customers’ ability to detect intrusions. Experts are split on impact—some praising the awareness and commitment-bias benefits, others calling it PR—while highlighting persistent challenges from legacy, vulnerability-centric AppSec practices and noting that if voluntary measures underperform, shifts in incentives or liability may be considered.