{"id":"https://openalex.org/W4413843745","doi":"https://doi.org/10.1145/3765287","title":"Incentivizing Secure Software Development: The Role of Voluntary Audit and Liability Waiver","display_name":"Incentivizing Secure Software Development: The Role of Voluntary Audit and Liability Waiver","publication_year":2025,"publication_date":"2025-08-30","ids":{"openalex":"https://openalex.org/W4413843745","doi":"https://doi.org/10.1145/3765287"},"language":"en","primary_location":{"id":"doi:10.1145/3765287","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3765287","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3765287","source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3765287","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5014742942","display_name":"Ziyuan Huang","orcid":"https://orcid.org/0000-0002-8939-6456"},"institutions":[{"id":"https://openalex.org/I27837315","display_name":"University of Michigan","ror":"https://ror.org/00jmfr291","country_code":"US","type":"education","lineage":["https://openalex.org/I27837315"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ziyuan Huang","raw_affiliation_strings":["Electrical and Computer Engineering, University of Michigan-Ann Arbor"],"raw_orcid":"https://orcid.org/0000-0002-8939-6456","affiliations":[{"raw_affiliation_string":"Electrical and Computer Engineering, University of Michigan-Ann Arbor","institution_ids":["https://openalex.org/I27837315"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002026615","display_name":"Gergely Bicz\u00f3k","orcid":"https://orcid.org/0000-0002-3891-3855"},"institutions":[{"id":"https://openalex.org/I29770179","display_name":"Budapest University of Technology and Economics","ror":"https://ror.org/02w42ss30","country_code":"HU","type":"education","lineage":["https://openalex.org/I29770179"]},{"id":"https://openalex.org/I4210132990","display_name":"State Key Laboratory of Cryptology","ror":"https://ror.org/02pn5rj08","country_code":"CN","type":"government","lineage":["https://openalex.org/I4210132990"]}],"countries":["CN","HU"],"is_corresponding":false,"raw_author_name":"Gergely Bicz\u00f3k","raw_affiliation_strings":["Laboratory of Cryptography and System Security, Budapest University of Technology and Economics"],"raw_orcid":"https://orcid.org/0000-0002-3891-3855","affiliations":[{"raw_affiliation_string":"Laboratory of Cryptography and System Security, Budapest University of Technology and Economics","institution_ids":["https://openalex.org/I29770179","https://openalex.org/I4210132990"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101967011","display_name":"Mingyan Liu","orcid":"https://orcid.org/0000-0003-3295-9200"},"institutions":[{"id":"https://openalex.org/I27837315","display_name":"University of Michigan","ror":"https://ror.org/00jmfr291","country_code":"US","type":"education","lineage":["https://openalex.org/I27837315"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mingyan Liu","raw_affiliation_strings":["Electrical and Computer Engineering, University of Michigan-Ann Arbor"],"raw_orcid":"https://orcid.org/0000-0003-3295-9200","affiliations":[{"raw_affiliation_string":"Electrical and Computer Engineering, University of Michigan-Ann Arbor","institution_ids":["https://openalex.org/I27837315"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.31981968,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"28","issue":"4","first_page":"1","last_page":"30"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11058","display_name":"Ethics in Business and Education","score":0.9523000121116638,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/waiver","display_name":"Waiver","score":0.9636238813400269},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.6710637807846069},{"id":"https://openalex.org/keywords/liability","display_name":"Liability","score":0.6355644464492798},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.6143684387207031},{"id":"https://openalex.org/keywords/finance","display_name":"Finance","score":0.3371383249759674},{"id":"https://openalex.org/keywords/accounting","display_name":"Accounting","score":0.32702574133872986},{"id":"https://openalex.org/keywords/actuarial-science","display_name":"Actuarial science","score":0.32591789960861206},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.32132044434547424},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.18751832842826843},{"id":"https://openalex.org/keywords/law","display_name":"Law","score":0.11803191900253296},{"id":"https://openalex.org/keywords/political-science","display_name":"Political science","score":0.08237287402153015}],"concepts":[{"id":"https://openalex.org/C2777543875","wikidata":"https://www.wikidata.org/wiki/Q797551","display_name":"Waiver","level":2,"score":0.9636238813400269},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.6710637807846069},{"id":"https://openalex.org/C2777834853","wikidata":"https://www.wikidata.org/wiki/Q96776939","display_name":"Liability","level":2,"score":0.6355644464492798},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.6143684387207031},{"id":"https://openalex.org/C10138342","wikidata":"https://www.wikidata.org/wiki/Q43015","display_name":"Finance","level":1,"score":0.3371383249759674},{"id":"https://openalex.org/C121955636","wikidata":"https://www.wikidata.org/wiki/Q4116214","display_name":"Accounting","level":1,"score":0.32702574133872986},{"id":"https://openalex.org/C162118730","wikidata":"https://www.wikidata.org/wiki/Q1128453","display_name":"Actuarial science","level":1,"score":0.32591789960861206},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.32132044434547424},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.18751832842826843},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.11803191900253296},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.08237287402153015}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3765287","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3765287","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3765287","source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3765287","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3765287","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3765287","source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3683362237","display_name":null,"funder_award_id":"W911NF1810208","funder_id":"https://openalex.org/F4320338281","funder_display_name":"Army Research Office"},{"id":"https://openalex.org/G6073930873","display_name":"FAI: Fairness in Machine Learning with Human in the Loop","funder_award_id":"2040800","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320338281","display_name":"Army Research Office","ror":"https://ror.org/05epdh915"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4413843745.pdf","grobid_xml":"https://content.openalex.org/works/W4413843745.grobid-xml"},"referenced_works_count":13,"referenced_works":["https://openalex.org/W38193589","https://openalex.org/W1483280370","https://openalex.org/W1998814183","https://openalex.org/W2158894011","https://openalex.org/W2160372331","https://openalex.org/W2475672541","https://openalex.org/W2794377947","https://openalex.org/W2981014813","https://openalex.org/W3175529152","https://openalex.org/W4245744559","https://openalex.org/W4385496457","https://openalex.org/W4407951824","https://openalex.org/W6891577682"],"related_works":["https://openalex.org/W1999774298","https://openalex.org/W3013600702","https://openalex.org/W2412440618","https://openalex.org/W1671492809","https://openalex.org/W4244501789","https://openalex.org/W2037457353","https://openalex.org/W1967231687","https://openalex.org/W3101499207","https://openalex.org/W1982638777","https://openalex.org/W2376495550"],"abstract_inverted_index":{"Misaligned":[0],"incentives":[1,79],"in":[2,11,20,60,191,226],"secure":[3,245],"software":[4,28,69,101,113],"development":[5],"have":[6],"long":[7],"been":[8,24],"a":[9,16,112,152,155,163,193,243],"challenge":[10],"security":[12,121],"economics.":[13],"Product":[14],"liability,":[15],"powerful":[17],"legal":[18],"framework":[19,137],"other":[21],"industries,":[22],"has":[23],"largely":[25],"ineffective":[26],"for":[27,68,80,96,178],"products":[29],"until":[30],"recent":[31,39],"times.":[32,171],"However,":[33],"the":[34,45,51,55,81,84,105,108,148,168,175],"rapid":[35],"regulatory":[36],"responses":[37],"to":[38,74,77,100,161,183,187,203],"global":[40],"cyber":[41,97],"attacks":[42],"by":[43],"both":[44,62,139],"US":[46],"and":[47,64,103,117,141,165,186,236],"EU,":[48],"together":[49],"with":[50],"(relative)":[52],"success":[53],"of":[54,66,83,107],"General":[56],"Data":[57],"Protection":[58],"Regulation":[59],"defining":[61],"duty":[63],"standard":[65],"care":[67],"vendors,":[70,145],"may":[71],"enable":[72],"regulators":[73],"use":[75],"liability":[76,109,126,234],"re-align":[78,240],"benefit":[82],"digital":[85,246],"society.":[86],"The":[87],"United":[88],"States":[89],"National":[90],"Cybersecurity":[91],"Strategy":[92],"suggests":[93],"shifting":[94],"responsibility":[95],"incidents":[98],"back":[99],"vendors":[102],"proposes":[104],"concept":[106],"waiver:":[110],"if":[111],"company":[114],"voluntarily":[115],"undergoes":[116],"passes":[118],"an":[119,159,179],"IT":[120],"audit,":[122],"its":[123],"future":[124],"product":[125,164],"is":[127,182],"(fully":[128],"or":[129,195],"partially)":[130],"waived.":[131],"This":[132],"article":[133],"examines":[134],"this":[135],"audit-liability":[136],"from":[138],"vendor":[140,156,181,212],"auditor":[142],"perspectives.":[143],"For":[144,198],"we":[146,200],"model":[147],"decision":[149],"process":[150],"as":[151],"sequential":[153],"problem:":[154],"must":[157],"pass":[158],"audit":[160,169,218,237],"release":[162],"can":[166,221,239],"attempt":[167],"multiple":[170],"We":[172,214],"show":[173],"that":[174,206,220],"optimal":[176],"strategy":[177],"opt-in":[180],"never":[184],"quit":[185],"exert":[188],"cumulative":[189,224],"investments":[190,225],"either":[192],"\u201cone-and-done\u201d":[194],"\u201cincremental\u201d":[196],"manner.":[197],"auditors,":[199],"explore":[201],"how":[202,233],"design":[204],"audits":[205],"encourage":[207],"voluntary":[208],"participation":[209],"while":[210],"maximizing":[211],"effort.":[213],"further":[215],"investigate":[216],"dynamic":[217],"designs":[219],"amplify":[222],"vendors\u2019":[223],"security.":[227],"Our":[228],"findings":[229],"provide":[230],"insights":[231],"into":[232],"waivers":[235],"strategies":[238],"incentives,":[241],"fostering":[242],"more":[244],"ecosystem.":[247]},"counts_by_year":[],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}