CISA: Most exploited vulnerabilities should have been eradicated decades ago

CISA says Secure by Design (SBD) adoption is still lacking: across 2024-2025, most KEV-listed, widely exploited flaws are decades-old, with injection-related bugs (e.g., XSS/CWE-79, OS command injection/CWE-78, SQL injection/CWE-89) among the most common. In 2024, seven of the top 10 CWEs in CVE records were also “stubborn weaknesses,” and seven of the top 10 in the KEV catalog made up 41.5% of KEV bugs; three of the top five KEVs trace to persistent issues like improper input validation (CWE-20), path traversal (CWE-22), and OS command injection (CWE-78). CISA also notes 2025 data remains similar, arguing the problem is organizational culture and developer workflows rather than technical complexity, and urging vendors to “own security outcomes” and provide SBOMs.

Analysis

The market implication is less about a near-term demand surge and more about a procurement filter getting stricter. If government buyers and large regulated enterprises start requiring evidence of secure development, SBOM discipline, and vulnerability hygiene, the cost of capital for sloppy vendors rises via slower renewals, more security questionnaires, and higher sales friction. That disproportionately pressures legacy enterprise software firms with large installed bases and older code paths, while benefiting vendors that can credibly sell “security built into the workflow” rather than bolted-on remediation.

The second-order winner set is broader than pure cyber: DevSecOps tooling, software composition analysis, code scanning, and supply-chain governance vendors should see a longer sales cycle tailwind as buyers try to externalize compliance work. Public comps with exposure include SNPS and GTLB; if federal language hardens, security posture becomes part of enterprise software diligence, which can widen moats for developers with mature secure SDLC practices. The loser side is not a single ticker but a basket of mature software names where patching and vulnerability management remain a drag on engineering efficiency and customer trust.

Timing matters: there is little reason to expect immediate revenue impact over days; the real catalyst path is 1-3 quarters as procurement teams translate guidance into RFP language, and 6-18 months if this becomes embedded in federal contracting and cyber insurance underwriting. The thesis is falsified if agencies keep the rhetoric but do not convert it into measurable buying criteria, or if software buyers continue prioritizing feature velocity over security evidence. Another risk is that the spend shifts to internal headcount/process rather than external vendors, limiting monetization for public cyber names.

Key Decisions for Investors

• Watchlist long SNPS and GTLB on any pullback: both have the most direct leverage to secure-development workflow adoption; entry only becomes attractive if management commentary starts referencing federal/regulated-enterprise demand acceleration over the next 1-2 quarters.
• Consider a relative-value pair: long cyber supply-chain/security tooling basket (SNPS, GTLB, ADBE? if developer workflow security features gain traction) vs short a legacy enterprise software basket (e.g., ORCL/CRM/WDAY) to express higher compliance drag on older codebases; thesis works best over 6-18 months, not days.
• Avoid chasing pure-play cyber beta on this headline; use it as an alert for procurement language changes. If federal RFPs begin explicitly requiring SBOM and secure-by-design attestations, that becomes a real catalyst for software-integrity vendors.
• Set a falsifier: if there is no change in government contract language or no increase in security/compliance spend commentary in upcoming earnings seasons, fade the trade and treat this as non-monetizable policy noise.
• For more tactical positioning, own medium-term upside optionality in SNPS or GTLB only if implied volatility is not rich; otherwise prefer common stock exposure, since the catalyst is slow-burn and unlikely to resolve within a single event window.