👨🏻‍💻 ⚡️

Written by policy wonks with ZERO understanding of tech. A company writes software it has a dependancy . That dependancy gets hacked in supply chain. Is the company responsible? Maybe but only after the supply chain tack is known and the company hasn't patched its software but after how long. A company uses a cyrptographic method which is found to be insecure is the company liable ? AI hacks can make any software insecure if tried hard enough so who is liable then? A company makes software but company doesn't secure the perimeter of the software so is really responsible for the breach who has liability? Cybersecurity insurance already exists. Security in cyber is multi layered, defence in depth , encryption ,edr, secure networks, 2fa, etc etc. Saas companies arlready have liability in contracts and this is often negotiated. This is an extremely broad brush approach and could be a nightmare to uphold because every single case would need complex real world cases to actually define how the law is implemented. This seems to me like a civil servants idea of 'cyber security attacks are increasing lets pass this onto vendor and hope that reduces attacks' pie in the sky mentality . Bro if a foreign actor is trying to hack you doesn't matter what your software vendor has done they WILL compromise you.