Security can’t be an afterthought
For years, the tech industry has treated security largely as a customer problem: patch your own systems, configure your own defenses, and hope for the best. CISA’s Secure by Design principles — backed by the agency and seventeen international partners — push back on that status quo. The goal is straightforward: software manufacturers should build products so that they are safe from the start, with security controls already in place by default, not sold as an add-on or bolted on after a breach.
The stakes are high. Our reliance on connected technology only grows, and so does the attack surface. In 2023, hackers with suspected ties to North Korea exploited software vulnerabilities to steal more than $300 million from individuals and companies — accounting for over 20% of crypto losses that year. The economic damage from insecure software isn't limited to one sector, either: a single flaw can ripple through entire industries, exposing user records, financial data, and login credentials.
CISA argues that too many vendors put the burden of security on their customers. But while customers do have a role to play, the majority of risk should be handled by the people designing the systems. When manufacturers take ownership of security outcomes, they reduce not only the risk to users but also the long-term maintenance and patching costs they face themselves.
The three principles
CISA's guidance centers on three specific product-security principles for software manufacturers:
- Take ownership of customer security outcomes
- Embrace radical transparency and accountability
- Lead from the top
In its documentation, CISA breaks down each principle into practical guidance on what security measures a manufacturer should follow.
Baked in, not bolted on
Secure by design means security is “baked in” rather than “bolted on.” Rather than addressing threats reactively after a flaw is found, manufacturers build products that already mitigate risk — designed in a way that makes it reasonably difficult for attackers to gain access in the first place.
Secure by default is the natural companion. The necessary security configurations are enabled by default, without requiring customers to pay extra or to know enough to turn the right settings on. Default security shouldn't be a premium feature.
What Cloudflare does
As a cybersecurity company, Cloudflare considers product security an integral part of its development work. It takes the same beliefs that underpin CISA's principles — that products should be designed to keep users safe — and applies them throughout the build process. The company's approach reinforces the industry-wide shift toward making security the baseline.
Building Security Into the Product, Not Bolting It On
CISA’s Secure by Design principles ask software manufacturers to shift their mindset: instead of selling products and patching flaws later, build the security in from the start. That means taking responsibility for customer outcomes, not just shipping code. For Cloudflare, that philosophy plays out across engineering practices, default product settings, and corporate structure.
Application Hardening at the Code Level
Cloudflare’s developers operate under a software development life cycle (SDLC) with security checkpoints at each stage. Vulnerabilities are patched proactively for all customers, not just those on premium plans. Two major projects illustrate the commitment to memory-safe languages: the Cloudflare WAF was rewritten from Lua into Rust in 2021, and the in-house HTTP proxy Pingora moved the company from C to Rust. Both were large-scale rewrites that required executive sponsorship from technical leadership.
Default Settings That Assume a Threat Model
New Cloudflare zones automatically deploy the Free Cloudflare Managed Ruleset, which includes rules for Log4j, Shellshock, and common WordPress exploits. Customers can disable or tune it, but the baseline is protected. The ML-computed WAF Attack Score goes further, using AI to detect bypasses of existing rules and identify exploits before they are publicly disclosed.
DDoS mitigation is unmetered by default on all accounts. R2 storage objects are encrypted at rest automatically, with no user configuration required and no performance penalty. Audit logs are available on every plan level for 18 months, capturing account-level actions like logins and zone configuration changes for both individual users and multi-user organizations.
Zero Trust by Default
Cloudflare aligns its internal access with CISA’s Zero Trust Maturity Model. Every person and device must verify identity before accessing Cloudflare resources, whether those resources are self-hosted or in the cloud. The company offers a free Zero Trust plan for up to 50 users to help small businesses adopt the same architecture.
Free Features That Moved the Industry
Cloudflare has a history of making security features free and pushing competitors to follow. Universal SSL brought free encryption to all customers in 2014, and full encryption from browser to origin followed in 2015. Unmetered DDoS mitigation, announced in 2017, eliminated the industry practice of surge pricing during attacks.
The MIGP protocol, announced in 2021, lets users check whether credentials have been compromised without sending those credentials—even encrypted—over the Internet. In 2022, WAF Managed Rulesets became free for all plans. Post-quantum cryptography was made available free of charge to all customers at the end of 2023.
Radical Transparency as a Security Control
Cloudflare’s blog documents new features but also serves as a record of security incidents, including the HTTP/2 Rapid Reset attacks and the Thanksgiving 2023 security incident, with technical detail about cause and remediation. The Cloudflare System Status page tracks live service health, ongoing incidents, and scheduled maintenance.
Technical transparency extends to code integrity. In 2022, Cloudflare partnered with WhatsApp to verify that users run untampered code when accessing the web version of the service. A code verify extension automates hash integrity checks, making tamper detection practical for non-technical users.
Semi-annual transparency reports disclose law enforcement and governmental requests for customer information. Warrant canaries implicitly inform users when Cloudflare has not received certain government orders, such as requests to turn over encryption keys. While not explicitly part of CISA’s principles, these practices support the transparency goal.
Public bug bounties on HackerOne invite external researchers to report vulnerabilities and receive compensation.
Security Seated at the Top
Cloudflare’s Chief Security Officer reports directly to the CEO and presents at every board meeting. Security engineers sit within the R&D organization alongside system engineers, ensuring security is part of the development process rather than an afterthought.
What You Can Do
Software manufacturers should review CISA’s Secure by Design principles and develop a plan for implementation. Individuals can participate in bug bounty programs and promote cybersecurity awareness in their communities.
