I could not agree more with the comments on transparency. That's the key to making sure that failures are brought to light as quickly as possible (fail fast) and remedied.

What I wonder is how the fact that Cisco is doing the right things and leaning in to this problem can be contrasted with other companies in an easily digestible way. Determining which companies are being honest and attempting to implement security mechanisms is such a huge lift for any consumer and/or integrator of technology. While transparency makes checking under the hood possible, it is still a huge undertaking to analyze even a single technology from a single vendor. This is only exacerbated given the myriad of technologies that must plan in concert to accomplish seemingly basic tasks these days.

I just wish there was a ubiquitous trusted vetting source out there that could really offer that quick insight into a company using sound, secure development principles. I realize the complexity and diversity of software makes implementing a catch-all, standardized approval mechanism extremely difficult if not impossible, but even offering simple guarantees ( i.e, a sticker denoting that all DiT is encrypted) might be enough to spur consumers to make better purchasing decisions and therefore put pressure on the producers to be more sound.

Regardless, glad to see that Cisco is doing more than its part to help bring these issues to light!