Security in software procurement

CISA asks buyers to make eliminated vulnerability classes a contract condition

Its review of fiscal 2024 and 2025 says opportunistic scanning of known, internet-exposed flaws drove most compromises. The fix, it argues, belongs to software producers, not to defenders patching faster.