68 Software Firms Sign CISA’s Secure-by-Design Pledge
A year since CISA’s initiative, tech companies say their products will have built-in security features from the start.

The Cybersecurity Infrastructure and Security Agency (CISA) this week said 68 software manufacturers, including big-tech giants like Microsoft and Google, voluntarily joined CISA’s Secure by Design pledge that aims to design technology with default security features, rather than security being an afterthought.
“More secure software is our best hope to protect against the seemingly never-ending scourge of cyberattacks facing our nation. I am glad to see leading software manufacturers recognize this by joining us at CISA to build a future that is more secure by design,” CISA Director Jen Easterly said in a press release. “I applaud the companies who have already signed our pledge for their leadership and call on all software manufacturers to take the pledge and join us in creating a world where technology is safe and secure right out of the box.”
Earlier this year, Easterly called on agencies to practice cyber hygiene and cited the secure-by-design framework. The pledge contains seven goals based on using multi-factor authentication, eliminating default passwords, reducing classes of vulnerabilities, increasing security patches, public disclosure of vulnerabilities, increasing transparency of vulnerabilities by reporting promptly and taking ownership of customers’ security outcomes. The companies that signed the pledge have one year to show progress.
While the pledge is focused on software products and services, like on-premise software, cloud services and software as a service, CISA encourages manufacturers of physical products to document their progress as well.
“Every software manufacturer should recognize that they have a responsibility to protect their customers, contributing to our national and economic security. I appreciate the leadership of those who signed on and hope that every technology manufacturer will follow suit,” said CISA Senior Technical Advisor Jack Cable.
To date, the following 68 companies have signed the pledge: 1touch.io, Akamai, Amazon Web Services, Apiiro, Armis, Automox, BigID, BlackBerry, Bugcrowd, Chainguard, Cisco, Claroty, Cloudflare, CrowdStrike, Cybeats, Resilience, ESET, Everfox, Finite State, Forescout, Fortinet, Gigamon, GitHub, GitLab, Google, Hewlett Packard Enterprise, HiddenLayer, HP, Huntress, IBM, Infoblox, InfoSec Global, Ivanti, Kiteworks, Lasso Security, Lenovo, Manifest, Microsoft, N-able, NetApp, Netgear, Okta, Palo Alto Networks, Pangea, Proofpoint, Qualys, Rapid7, Red Queen Dynamics, Scale AI, Secureworks, Securin, Security Compass, SentinelOne, Socket, Sonatype, Sophos, Tenable, ThreatQuotient, ThriveDX, Tidelift, Trellix, Trend Micro, Vanta, Veracode, Veritas Technologies LLC, Wiz, Xylem and Zscaler.
This is a carousel with manually rotating slides. Use Next and Previous buttons to navigate or jump to a slide with the slide dots
-
Platform One Tackles Next Phase in Software Delivery
The software delivery engine sets its sights on DevSecOps infrastructure and preparing for a post-quantum future as it matures.
7m read -
Pentagon's Software Modernization Plan Targets Speed
Pentagon software modernization shifts toward agile development and integration of user feedback to maximize operational capabilities.
6m read -
Interior Taps New Acting Deputy CIO
Lou Eichenbaum, who previously served as Department of Interior's zero trust program manager, becomes acting deputy CIO.
2m read -
Federal IT Efficiency Summit
The CyberScape Summit will bring together federal and industry thought leaders to explore key priorities in cybersecurity and stay ahead of evolving challenges.
To Be Announced