Why we started the Software Safety Institute

Thanks for being here.

The Software Safety Institute is a nonprofit built on a simple idea: software should be safe by design. Today, the cost of unsafe software falls mostly on the people and organizations who use it. They’re told to install updates, spot scams, and buy more security products, while the root causes sit upstream with the software manufacturers who build the products. We think that’s backwards.

What we believe

Safety should be built in, not bolted on. Many of the most common security defects have been understood for decades, and whole classes of them can be prevented through better design choices. Responsibility should rest with those best positioned to prevent harm, which means the makers of software. Other industries, from automobiles to aviation, made this shift. Software can too.

What we’re working on

Our work falls into three areas. We conduct research that uses public data to show how software safety is, and isn’t, improving. We develop policy ideas that align incentives so that building safe software is the norm rather than the exception. And we tell the story of why this matters, starting with The Software Safety Project, a podcast whose first series, The Bug We Let Live, explores memory safety and why we’ve tolerated it for so long.

What to expect from this newsletter

We’ll write when we have something worth your time: new research, podcast episodes, policy work, and the occasional argument we think needs making. If something resonates, or you think we’ve gotten something wrong, reply to any issue. Your note comes straight to us.

You can learn more about our work at softwaresafety.org and follow us on Bluesky here.

Lauren and Bob
The Software Safety Institute