In my 19 years in the cybersecurity industry, I have used Cybersecurity Awareness Month in October to sound the alarm about basic digital hygiene and urge internet users to use stronger authentication methods than passwords, avoid clicking on suspicious links, and keep their software updated. This year, I am taking a different approach. With the accelerating number of cyber breaches it is obvious that putting the responsibility for a broken internet on the user, is neither fair nor effective.
There are far better and proven security strategies.
The internet has transformed our daily lives, how we communicate, do business, and run our governments. It has put extraordinary capabilities in our hands. But it was designed for openly sharing information between researchers, not for security. Today, cyberattacks are by far the biggest and fastest growing global crime of all, impacting every part of our society. Hospitals have shut down. Water systems have suffered disruptions. Families are losing their life savings. And with more fake identities and bots and fake content than real people, the trust in our entire digital world is at stake.
We are facing a crisis. But we also have the power to do something about it. The internet is not the only technology whose use has outpaced its safety measures: Airplanes, boats and cars have become safer through the efforts of many stakeholders.
Consider the auto industry as an example. The overall safety for drivers has improved 18 times over the course of a century: In 1923, the United States recorded about 21 highway fatalities for every hundred million miles travelled. In 2024, the figure was down to 1.19. By this measure, driving became nearly 18 times safer, while annual traffic on U.S. roads grew from 85 billion vehicle-miles to nearly 3.3 trillion, almost 39 times as many miles driven.
This did not happen because drivers became 18 times more careful.
Instead, we changed the system around them. Cars and roads became safer. Standards and testing improved. Crashes were investigated by an independent body whose findings the whole industry had to act on. Manufacturers became liable for defects. Driver behavior still mattered, but safety no longer depended on every driver getting everything right
Notice what the road-safety movement did not do. It did not run awareness campaigns telling drivers to be more careful and call it a strategy. It did not let manufacturers write the crash reports. It did not accept “drivers should have known better” as an explanation for deadly auto accidents.
The internet is not unlike a road network, but we cannot afford to take a century to achieve better safety standards. Our lesson learned is that security can improve while usage grows. Every other safety-critical industry became more responsible through the same combination: safety engineering, testing, standards, mandatory reporting, liability and regulation, plus a mechanism for learning from failure.
For internet security, there are two major attack vectors that cause the vast majority of breaches. For rapid, systemic change, we need to focus on driving solutions for these threat vectors; insecure logins and identities, and software.
According to America’s Cyber Defense Agency CISA, more than 90% of all successful cyberattacks begin with a phishing email. The FIDO passkeys open authentication standard, replacing passwords and other insecure login methods, is the only solution proven to stop phishing attacks and account takeovers at scale. With small improvements, it can be the default secure login for all digital services. Combined with the open and privacy preserving identity wallets that all EU countries are moving towards, it can also help to securely distinguish verified humans from fake identities and bots.
The second largest cyber threat is software vulnerabilities, which according to Verizon Data Breach Investigations Report, account for 31% of cyber breaches. To drive more secure software at scale, there are two promising solutions worth mentioning; the EU Cyber Resilience Act (CRA), that will fine digital services that do not report software vulnerabilities shortly after its discovery, and Prossimo, a global initiative to rewrite hundreds of open source projects that many digital services are built on in more secure code
As we near the end of Cybersecurity Awareness Month, today I have started a new initiative named Ten Times Trust (or 3T). Inspired by the safety success formula of the motorcycle security movement, the goal for 3T is to bring awareness to and in different ways support the global initiatives that will help to build a ten times safer internet in ten years.
It’s an ambitious goal with a tight timeline, but I believe it’s achievable. By building on existing open standards and open-source initiatives – many already proven at scale – and closing the remaining gaps over the next few years, we can deliver solutions that make a meaningful, positive impact for the greatest number of internet users.
The two organizations I founded, Yubico, and SIROS Foundation, have contributed and will continue to contribute some of the authentication and identity open standards elements for the Ten Times Trust ecosystem. Complementing solutions have and are being developed by a global community of standards bodies, NGOs, tech giants, lawmakers, researchers, and more. The trust relationship between members of this community spans across decades and continents, as we have worked together to solve critical challenges, and co-developed many of the solutions. We did this because we have recognized that we share the same concerns and aspirations; the internet is too important to fail, and we need to do what we can to help make it better and safer for all.
Ten Times Trust starts today, as an informal, no membership, no fee, awareness initiative and vision. Initially led by the Swedish non-profit foundation, we will present a more detailed execution plan early next year.
I want to give my thanks to the Software Safety Institute, founded by former CISA staff members that led the Secure By Design initiative and have contributed valuable insights and content for 3T and this blog.
We have made our roads safer without expecting perfect drivers. Internet users need to continue to be careful, but we will see far more positive change when organizations who design, run and regulate a digital service make users’ safety a priority. And I will spend the coming ten years as one of the many contributors building an internet that protects us even when we make mistakes.
