Memory Safety Roadmap: The 1,000x Case

Here is the rule. Under the Product Security Bad Practices guidance from CISA and the FBI, a maker of software used in critical infrastructure that had no published memory safety roadmap by January 1, 2026 is, in the agencies' own word, "dangerous". The date came and went. Your firewall vendor, your hospital's imaging supplier, the firm behind your water utility's control panels: none of them owed you a thing when it passed.

The flaw is in the rule. The same document says it "is non-binding" and "imposes no requirement", so the risk of a missing plan sits with you, the customer. It should be compulsory. And the standard objection, that leaving C and C++ is too slow and too costly, no longer survives the data.

Is CISA's memory safety guidance mandatory?

No, CISA's memory safety guidance is voluntary: the agencies call a missing roadmap dangerous for critical-infrastructure software, but attach no fine and no procurement ban, so a vendor that ignored the January 2026 date faces nothing.

Washington has stayed in that register. A June 2025 NSA and CISA information sheet on memory safe languages (Rust, Go and others that stop code touching memory it does not own) says the agencies "urge organizations to consider whether adopting MSLs is practical for their circumstances." That hands every vendor two exits, "consider" and "practical". A buyer waiting for a federal push is waiting for something the government has said, in writing, it will not do.

Other regulators have been less shy. Europe wrote vulnerability handling into law, down to the 24-hour exploited-vulnerability warning the Cyber Resilience Act demands. Even NIST put calendar years on its post-quantum migration deadlines. Memory safety, the older and better-understood problem, got an adjective.

Is Rust really safer than C++?

Yes, by a margin that ends the argument. A November 2025 Google report, Rust in Android, found its roughly 5 million lines of Rust running at about 0.2 memory-safety vulnerabilities per million lines, against roughly 1,000 in its C and C++, a reduction Google puts at more than 1,000x. That kills the excuse that safer languages just move bugs elsewhere.

But the objection was always about cost: rewriting slows teams, and ship dates pay salaries. Four numbers test that. Google's Android data supplies two, measured on changes of comparable size. MITRE's CWE Top 25, released in December 2025, supplies a count of memory errors among the most dangerous weaknesses. The calendar supplies the last.

Show the rollback figure to a sceptical finance director. A rollback is a release pulled after shipping, usually an outage and a lost weekend. Fewer of those means the cost objection runs backwards.

With no regulator compelling a plan, your contract is the only lever left.

What a required memory safety roadmap changes for buyers

Requiring the plan turns a vendor's vague intention into a dated, auditable commitment that covers its riskiest code first, which gives a buyer something to enforce at renewal instead of a hope.

The flaw-rate row is my arithmetic, not Google's: Android's measured densities scaled to a 100,000-line component. At those rates a new C++ service carries latent memory flaws in triple figures, and the Rust version most likely none.

Where a compulsory roadmap gets hard

A compulsory plan gets hard in two places: products close to retirement, which the guidance already exempts, and vendors who publish a roadmap with no dates in it, which satisfies the letter while changing nothing.

Do software makers have to stop using C and C++ by 2026?

No. The CISA and FBI guidance asks existing products for a plan, not a rewrite, and only calls new critical-infrastructure product lines in C or C++ dangerous where a memory-safe alternative exists. I'd go further than CISA, or at least put it more bluntly: a roadmap without a year beside each component is a brochure.

The unresolved question, in my opinion, is embedded firmware. A substation controller will not be rewritten, and a plan for it may mean little beyond the next model. Newer guidance shares the gap, such as the NSA's May 2026 advisory on MCP security for AI agents: sound advice, no teeth. Watch for:

• Goals with no year per component.
• Memory-safe claims covering only new features.
• An end-of-support date just inside the exemption.
• Sandboxing sold as a substitute, not a stopgap.

If two of those are true, stop waiting for Washington. This week, email the vendor asking for its published plan and support end date, and tell procurement that renewal now depends on a dated commitment, cryptographic code first. Require it yourself, because nobody else will.