For years, the security industry has treated vulnerabilities as an endless queue of individual fixes. A recent CISA review argues that this is precisely why attackers keep winning. The solution to this problem, they believe, is eliminating entire categories of weaknesses at the source.
“By reducing these root causes during software development, providers can help prevent vulnerabilities that are more likely to be targeted by threat actors,” the US cybersecurity agency says.
But that’s easier said than done, especially when you know that CISA has been urging software vendors to implement Secure by Design principles in their software development lifecycle for many years, and too many have moved too slowly in the right direction.
A small set of flaws, endlessly recycled
The CISA Vulnerability Review: Fiscal Years 2024 and 2025, published in August 2026, makes the following unsettling observation: most compromises in that period did not involve nation-state zero-days or advanced tradecraft, but came from opportunistic criminals scanning the internet for exposed, known vulnerabilities created by insecurely written software.
The finding dovetails with Verizon’s 2026 Data Breach Investigations Report, released earlier this year, which found that vulnerability exploitation is now the most common way attackers gain initial access to target networks.
CISA’s data shows the same weaknesses recurring year after year. Analyzing the Common Weakness Enumeration (CWE) tags across published CVEs, the review found a persistent cluster of avoidable coding errors – injection flaws, improper input validation, memory-safety failures, path traversal, and broken access control – driving a disproportionate share of real-world exploitation.
Vulnerabilities added to CISA’s KEV catalog in 2025 and the associated weakness classes (Source: CISA)
In CISA’s Known Exploited Vulnerabilities (KEV) catalog, 41.5% of entries map to what MITRE calls “stubborn weaknesses”: flaw types that have appeared on the CWE Top 25 nearly every year since 2019.
CISA also mentions MITRE’s 2007 report outlining “unforgivable vulnerabilities”, i.e., flaws stemming from a well-documented mistake, with an obvious attack path and a trivial exploit.
By that standard, three of today’s ten most common CWEs would have been considered unforgivable two decades ago. Their survival, CISA argues, is not a technical puzzle but a failure of organizational culture and Secure by Design adoption.
Why aim for vulnerability class elimination?
Because a handful of weakness classes generate so many individual vulnerabilities, addressing the class removes many bugs at once, including ones not yet discovered.
Rather than asking defenders to patch faster forever, CISA says the onus should be on software producers to build products secure at inception by:
- Automating configuration and updates
- Owning security outcomes for customers
- Embedding security into every phase of design and development, and
- Eliminating common vulnerability classes (and publishing roadmaps for the rest).
In the review, CISA pairs recurring weakness – memory safety, improper input validation, injection, file handling, access control – with the practices that close it, while also warning that many exploited vulnerabilities span multiple weakness categories, so developers should prioritize fixing weaknesses that threat actors commonly exploit together.
CISA admits the shift it wants is a heavy lift: building security in, the agency writes, “requires technical discipline and executive buy-in.”
There are also harder economic obstacles. Eliminating memory-safety flaws, for example, often means rewriting large C/C++ codebases in memory-safe languages, which can be a multi-year, expensive undertaking.
The review also does not address why years of voluntary Secure by Design pledges have underdelivered, or offers solutions to vendor resistance to “owning security outcomes”, when that phrase hints at legal liability.
Turning the market into an ally
One of the ways to effect a systemic change is in the hands of buyers. CISA’s Secure by Demand guidance encourages buyers to make security a contract condition.
They should be asking vendors which vulnerability classes they have already eliminated, whether they provide a machine‑readable software bill of materials (SBOM), whether the product offers phishing-resistant authentication by default, whether security logs are included in the base product, and more.
While acknowledging that consumers and small business continue to shoulder a disproportionate share of the cybersecurity burden, CISA hopes that with enough buyers asking the same questions and rewarding producers who build security into their products, vendors will have to adapt.
“Securing the software ecosystem is a shared responsibility. Software producers and end-user organizations both play a critical role,” the agency noted, and says they should start implementing provided guidelines as quickly as possible because of what is expected to happen next: the explosion of AI-enabled vulnerability discovery and adversaries being able to automate the full exploitation chain.