Software makers carry primary responsibility for shipping products that are secure by design, according to CISA. Buyers are not off the hook, since they configure, update and monitor what they run. A fair split gives the maker the build and the buyer the setup.
What CISA says
CISA's Secure by Design guidance says software manufacturers bear primary responsibility and urges them to take urgent steps to ship products that are secure by design. It names three principles: take ownership of customer security outcomes, embrace radical transparency and accountability, and lead from the top. It also says the guidance gives customers the means to evaluate manufacturers' progress, creating a demand signal for secure by design.
A practical split
| Area | Mostly the maker | Mostly the buyer |
|---|---|---|
| Flaws in the product code | Yes | |
| Components inside the product | Yes | Ask for a list |
| Releasing fixes | Yes | |
| Applying fixes | Yes | |
| Configuration and access | Safe defaults | Setting it correctly |
| Monitoring in your environment | Yes |
This is a way to think, not a legal allocation. Contracts and laws decide actual liability, so involve counsel for that.
How buyers create the demand signal
Ask the same short set of questions of every supplier and compare answers over time. Which security defaults ship on? How are flaws reported and fixed? What can you show about the components inside? How long are updates supported?
Common buyer mistakes
- Treating a signed contract as a security control
- Skipping updates because the vendor is responsible for the flaw
- Never asking what is inside the product
- Keeping unsupported versions running
A one page vendor review
Ask for owner name, security contact, update policy, list of components on request, and how they notify customers of serious issues. File the answers where the renewal owner can find them.
Where Safeguard fits
Safeguard produces SBOMs and scans dependencies, and its reachability analysis shows which findings your code actually uses. You can run a free scan on a repository to see an inventory for yourself.
Quick check
If the vendor is responsible, why do I need to update?
A fix only protects you once it is installed. Responsibility for the flaw and responsibility for applying the fix are different.
Does Secure by Design bind buyers?
It is guidance aimed mainly at manufacturers. Buyers can use it as a yardstick.
Sources
Last reviewed: 19 October 2026.
