Secure by Demand: Key takeaways for enterprise software buyers

CISA’s Secure by Demand guide complements Secure by Design by giving enterprise buyers practical checks to demand from software producers—such as simple patching, secure authentication (SSO/MFA/passkeys), baseline security logging, SBOMs and OSS vetting, vulnerability reporting transparency, and addressing classes of vulnerabilities—to shift accountability and improve product security. Framed against rising third‑party software risks highlighted in the 2024 Verizon DBIR and historic supply chain compromises (e.g., SolarWinds, 3CX), the piece urges buyers and producers to adopt comprehensive supply chain risk controls beyond vulnerabilities alone, emphasizing growing regulatory expectations and market pressure.