Governments Embrace Secure by Design to Curb Cyberthreats

Governments are ramping up efforts to shift from reactive cybersecurity to proactive prevention. Vulnerabilities have now overtaken phishing as the most exploited access vector for breaches, according to the 2025 Data Breach Investigations Report. Jen Ellis, founder of NextJenSecurity, said the continuing exploitation of well-known vulnerabilities signals a pressing need for policy changes that prioritize secure-by-design principles.

See Also: Enterprise Browser Transforms App Delivery and Compliance

“We have the ‘Known Exploited Vulnerabilities Catalog’ from CISA, which helps prioritize patching. But for organizations, it is difficult to keep up with it, which is part of the reason that secure by design has become such a critical movement,” Ellis said.

Countries are experimenting with divergent approaches, with the United Kingdom favoring a technology-specific policy framework, the United States pursuing a broad, pledge-based model and the European Union advancing legislation to mandate vulnerability reporting. These moves reflect a growing consensus: Without deeper structural reform, the cycle of vulnerability exploitation will continue.

In this video interview with Information Security Media Group at Infosecurity Europe 2025, Ellis also discussed:

• The Pall Mall Process and global controls on commercial cyber intrusion tools;
• Challenges of securing small and medium businesses in ransomware resilience efforts;
• The Ransomware Task Force’s evolving focus toward critical infrastructure security.

Ellis is focused on advancing cybersecurity and improving public safety through active collaboration with security experts, policymakers, industry leaders and other influencers. She has more than 20 years of experience in consulting, cybersecurity, communications and business development. She is a co-chair of the Ransomware Task Force.