Black Duck's Boris Cipot names Microsoft, Google, Amazon and Cloudflare as Rust adopters in production

A memory-safe rewrite would not have closed about 19 of the zero days Google counted being exploited in 2021. Sixty-seven percent of 58 is roughly 39, and the remaining 19 were something other than memory-safety bugs ^[5][19]. The other Google figure carried in the CISA and NSA report, 75 percent of the CVEs used in detected in-the-wild exploits, comes from a different sample, so the share cited moves 8 points depending on which set is quoted ^[4][20].

The article's own sources do not agree on how far adoption has gone. "Major technology providers such as Microsoft, Google, Amazon, Cloudflare, and parts of the Linux ecosystem are actively adopting Rust or other memory-safe approaches in production systems," said Boris Cipot, a security engineer at Black Duck Software ^[7]. Jeff Williams, chief technology officer and co-founder of Contrast Security, measured the installed base instead: "There is an entire mountain range of software built in non-memory-safe languages. And there is a tiny amount of action in the foothills to switch" ^[11]. The two statements use different denominators, production systems at a few large providers against deployed C and C++ everywhere else.

Cipot says the question put to defenders has changed. "The recent NSA and CISA guidance reflects this shift by focusing not on whether memory-safe languages are beneficial, but on how organizations can realistically adopt them," he said ^[8]. John Strand, owner of Black Hills Information Security, dates the turn to the kernel: "When you started seeing Rust incorporated into the Linux kernel, that was kind of the opening shot in the race to see this become more mainstream. And I think we're just going to see it become more mainstream moving forward" ^[10].

Dmitry Polyakovsky, a lead principal platform software engineer at Oracle, expects Rust to gain ground while legacy C and C++ stays in place ^[15]. "Rust can be a bridge for integrating new features into existing complex C/C++ codebases. As more developers become comfortable with Rust, new projects will be started in Rust from the beginning," Polyakovsky said ^[14].

A customer cannot check any of that. The adoption evidence here is supplier roadmaps and practitioner assessment, and the article does not report a procurement requirement, a contract term or an attestation that would let a buyer confirm which language shipped in a binary ^[21]. Practitioners quoted in the same piece warn that memory-safe languages address one category of vulnerability and that legacy C and C++ is too deeply embedded to replace wholesale ^[17]. Williams said eliminating one class of vulnerability is likely to introduce others, and that organizations have no reason to abandon versions already proven in production ^[13]. The report itself asked for road maps, and framed strategic MSL adoption as an investment in a secure software future ^[6].