By Rustify Team, updated March 2026
TL;DR: The US government has officially recommended moving away from C and C++ toward memory-safe languages. Rust is named explicitly in NSA, CISA, and White House guidance as the leading systems-level option.
- 70% of Microsoft's CVEs are memory safety bugs; a number consistent across Google, Apple, and the Linux kernel
- NSA guidance (2022): recommends Rust, C#, Go, Java, Python, Swift as memory-safe languages
- White House ONCD report (2024): calls C and C++ "too dangerous" for new software
- CISA guidance (2023): names Rust as the preferred low-level language for memory-safe rewrites
- Career impact: government contractors, defense, and regulated industries are now requiring memory-safe languages; driving Rust demand
Who Should Read This?
This article is aimed at software engineers, engineering managers, and technology leaders who work in industries with regulatory or government exposure; defense contractors, financial services, healthcare technology, and critical infrastructure. If you are a senior engineer at a defense prime or a startup bidding on federal contracts, understanding the policy landscape directly affects hiring decisions, technical roadmaps, and procurement outcomes. It is also relevant for Rust learners who want to understand why the career trajectory for Rust skills is so strong: government mandates are creating mandatory demand that persists regardless of technology fashion cycles. In the US market, Rust engineers in defense-adjacent and regulated sectors command $180K–$250K at senior levels; significantly above the already-elevated general Rust salary premium.
Why Did the US Government Start Caring About Memory Safety?
Memory safety vulnerabilities; buffer overflows, use-after-free, null pointer dereferences; account for the majority of exploitable security bugs in software, and they are almost entirely preventable with the right language choice.
The scale of the problem became impossible to ignore. In 2019, Microsoft's Security Response Center disclosed that approximately 70% of all CVEs they patched over the previous 12 years were memory safety issues; a figure the MSRC blog post described as "consistent year over year." The same year, Google reported that 70% of Chrome's high-severity security bugs were memory safety related. The Android security team reported 68% in its 2022 transparency report. These are not outliers; they're consistent numbers across the most security-conscious software organizations in the world, and they form the empirical backbone of the subsequent NSA, CISA, and White House policy cascade.
The pattern is clear: the memory safety problem is not an engineering quality problem, it is a language design problem. Teams writing C and C++; even expert teams at Microsoft and Google with world-class security review processes; cannot eliminate memory safety bugs at scale. The bugs are too subtle, the language provides no systematic protection, and the attack surface is too large.
This realization, compounded by a decade of high-profile exploits (Heartbleed, EternalBlue, the iOS kernel exploits), drove US government agencies to act.
What Did the NSA Recommend in Its 2022 Guidance?
The NSA's November 2022 cybersecurity information sheet, "Software Memory Safety" (CSI-SOFTWARE-MEMORY-SAFETY), explicitly recommended that organizations transition to memory-safe programming languages, naming Rust as a preferred low-level option.
The NSA document, titled "Software Memory Safety," listed memory-safe languages in two categories:
Languages the NSA considered memory-safe:
| Language | Type | Notes |
|---|---|---|
| Rust | Systems/compiled | Preferred for low-level; memory safety at compile time |
| C# | Managed | Microsoft ecosystem |
| Go | Compiled/GC | Good for cloud services |
| Java | Managed/JVM | Mature ecosystem |
| Python | Interpreted | Not for performance-critical code |
| Swift | Compiled | Apple ecosystem |
The NSA distinguished Rust from the other languages on the list: Rust provides memory safety without a garbage collector, through compile-time ownership rules. This makes it the only viable replacement for C and C++ in systems programming, embedded, and performance-critical domains where a garbage collector's unpredictable pauses are unacceptable.
The guidance explicitly called out C and C++ as languages that "make it too easy for developers to introduce memory safety issues" and recommended that organizations "use a memory-safe language when possible."
What Did the White House Report Demand in 2024?
The White House Office of the National Cyber Director (ONCD) published a report in February 2024 calling on the technology industry to eliminate memory-unsafe languages from new software; the strongest government statement yet.
The report, "Back to the Building Blocks: A Path Toward Secure and Measurable Software," framed memory safety as a national security issue, not just a software quality issue. Notably, the ONCD report explicitly cited the same Microsoft 70% and Google 68% statistics to make the case that the problem is systemic and language-level, not an engineering discipline failure. Key findings:
- C and C++ are explicitly described as "unduly dangerous" for new development
- The report calls on the private sector to proactively transition to memory-safe languages
- It recommends that software manufacturers create memory safety roadmaps
- It proposes that the federal government use its purchasing power to incentivize memory-safe software
The language in the report is unusually direct for a government document: "The technology community has tools to eliminate entire classes of vulnerabilities. The time is now to use those tools."
Rust is not the only language mentioned; but it is the only named language suitable for systems programming. For cloud, web, and application-layer software, other managed languages suffice. For anything touching hardware, kernels, or performance-critical infrastructure, Rust is the recommended path.
What Did CISA's Secure by Design Guidance Say?
CISA's "Secure by Design" principles (2023, updated 2024) listed moving to memory-safe languages as a Tier 1 technical control; the highest priority for reducing attack surface.
CISA's guidance went further than the NSA's by addressing software manufacturers directly, not just end users. It argued that software companies have a responsibility to eliminate memory safety vulnerabilities before shipping; rather than patching them afterward.
Key positions:
- Memory-unsafe languages should not be used for new projects without documented justification
- Existing C/C++ codebases should have a roadmap for incremental migration to memory-safe alternatives
- CISA named Rust specifically as the recommended language for systems-level memory-safe development
- The guidance called out "security through obscurity" as insufficient: language-level safety is required
CISA co-signed the 2023 "Secure by Design" guidance with cybersecurity agencies from the UK (NCSC), Australia (ASD), Canada (CCCS), New Zealand (NCSC-NZ), and Germany (BSI): making it a multinational policy recommendation, not just a US one. A companion CISA document, "The Case for Memory Safe Roadmaps" (December 2023), provided the specific technical and organizational guidance for how software manufacturers should execute the transition, including how to document progress for auditors.
3 spots open this month → Check if you are eligible.
We help experienced developers transition into Rust roles at €80K–€150K+ in Europe or $130K–$200K+ in the US.
How Have Major Tech Companies Responded?
Google, Microsoft, AWS, Meta, and the Linux Foundation have all publicly committed to memory-safe language adoption; with Rust as the primary vehicle for systems-level code.
| Organization | Action |
|---|---|
| Rust is now an officially supported language in Android AOSP; Chromium team adding Rust; $1M donation to Rust Foundation | |
| Microsoft | Rust approved for Windows kernel development; Azure team migrating performance-critical components; co-authored "Why Rust?" internal guidance |
| AWS | Firecracker (Lambda's hypervisor) written in Rust; Rust now standard for performance-sensitive services; Tokio maintainer on staff |
| Meta | Rust in production for buck2 build system, WhatsApp backend components; active Rust hiring |
| Linux Foundation | Rust approved as a second implementation language in the Linux kernel in 2022; drivers now being written in Rust |
| US DoD / DARPA | Memory-safe language requirements being incorporated into defense acquisition contracts; DARPA's TRACTOR program funds automated translation of C code to safe Rust |
The Linux kernel inclusion is particularly significant: Linus Torvalds, who historically resisted adding languages to the kernel, approved Rust after years of discussion. The first Rust drivers appeared in kernel 6.1 (December 2022). By 2026, there are dozens of Rust subsystems in the kernel.
What Is the Technical Reason Rust Provides Memory Safety Without a GC?
Rust's ownership and borrow checker system guarantees memory safety at compile time; eliminating use-after-free, buffer overflow, and data race bugs without runtime overhead.
The three rules that make this possible:
-
Every value has exactly one owner; when the owner goes out of scope, the value is freed. No manual
free(), no garbage collector. -
You can have many immutable references OR one mutable reference, never both simultaneously; this eliminates data races and use-after-free bugs at compile time.
-
References cannot outlive the value they point to; the borrow checker enforces this via lifetime analysis. Dangling pointers are impossible in safe Rust.
Compare to how other languages handle memory safety:
| Approach | How | Tradeoff |
|---|---|---|
| Garbage Collector (Go, Java, Python) | Runtime tracks live objects, frees unreachable ones | GC pauses, higher memory usage, unpredictable latency |
| Automatic Reference Counting (Swift, Python) | Runtime tracks reference counts | Cycles leak memory, reference counting overhead |
| Manual memory (C, C++) | Programmer allocates and frees | Fast, but one mistake = CVE |
| Rust ownership | Compile-time rules verified by borrow checker | No runtime cost, no pauses; but requires learning the rules |
Rust is the only approach that provides memory safety with zero runtime overhead. This is why it's the answer for systems programming that the other managed languages cannot fill.
Bottom line: For systems code where garbage-collector pauses are unacceptable; kernels, real-time systems, embedded, high-throughput network infrastructure; Rust is the only memory-safe language on the NSA/CISA recommended list that can actually replace C or C++.
What Does This Mean for Your Rust Career in 2026?
Government mandates and corporate policies are creating mandatory Rust adoption in defense, critical infrastructure, and regulated industries; expanding the job market beyond pure tech companies.
The practical career implications:
Defense and government contractors are now required to justify the use of memory-unsafe languages in new projects. Rust engineers are in demand at Lockheed Martin, Raytheon, Palantir, and dozens of defense-adjacent software companies; not because of hype, but because of procurement requirements.
Critical infrastructure (power grids, water systems, financial exchanges) is facing regulatory pressure to demonstrate memory safety. Rust engineers with domain knowledge in embedded systems, networking, or real-time systems are particularly valuable here.
Major cloud providers (AWS, Google Cloud, Azure) have made Rust a standard part of their systems stacks. New services at these companies are increasingly expected to justify not using Rust for performance-critical components.
Salary premium preservation: the supply/demand gap in Rust is widening as demand accelerates due to policy requirements while the talent pool grows more slowly. Senior Rust engineers in defense-adjacent and regulated sectors earn $180K–$250K in the US; a $40K–$65K premium over comparable Python or Java roles that shows no sign of narrowing.
Bottom line: Government mandates are creating non-discretionary Rust demand in defense, critical infrastructure, and federal contracting; the strongest near-term Rust job market is driven by procurement rules, not developer trends.
What Common Mistakes Do Organizations Make When Responding to Memory Safety Mandates?
-
Treating the mandate as a checkbox rather than an architecture decision. Organizations that scramble to "add Rust" to satisfy a CISA checklist without rethinking their highest-risk code surface end up with Rust wrappers around unsafe C: which provides no safety benefit. The mandate's intent is to eliminate memory-unsafe code at the language boundary, not to change what programming language appears in a job requisition.
-
Underestimating the training investment. Rust's ownership model requires 4–8 weeks of structured learning before engineers become productive. Organizations that assume C++ engineers will "just pick it up" as needed typically see a 6-month slowdown in the first team to adopt Rust. Budget for training before the deadline.
-
Starting with the wrong codebase. The guidance recommends starting with the highest-risk code: network-facing parsers, input validation, components that handle untrusted data. Starting with a low-risk internal utility tool produces no security benefit and delays the payoff.
-
Ignoring the Rust Foundation's security audit program. The Rust Foundation funds regular third-party audits of critical crates. Organizations using crates for cryptography, networking, or parsing should verify that those crates have been audited. Switching to Rust does not eliminate supply chain risk if your dependencies are unmaintained.
-
Conflating "written in Rust" with "memory-safe." Rust has
unsafeblocks. A codebase that usesunsafeextensively: either directly or through unaudited FFI bindings; may be no safer than C++. The government guidance targets safe Rust. Code reviewers should flagunsafeusage and require justification. -
Not documenting the transition roadmap. CISA's guidance specifically requires that organizations with existing C/C++ codebases produce a documented memory safety roadmap. Without documentation, organizations are vulnerable to audit findings even if they are making genuine progress. The roadmap should identify the current C/C++ surface area, the priority order for migration, and the timeline.
How Can Structured Training Accelerate Your Organization's Rust Transition?
For organizations facing government contract requirements or internal security mandates, the bottleneck is almost always talent; not tooling. The tools for Rust development in 2026 are excellent; the gap is engineers who can use them effectively. If you want a structured path for individual engineers or small teams to reach production-ready Rust proficiency in weeks rather than months, Rustify's 9-week bootcamp offers 1:1 coaching with a curriculum built around real systems programming; the exact skills that defense contractors and infrastructure companies are hiring for.
Frequently Asked Questions
No; rewriting billions of lines of existing, working C and C++ code is neither practical nor necessary. The guidance focuses on new development and on the highest-risk existing code (network-facing, handling untrusted input). Legacy codebases will coexist with Rust for decades. The pragmatic approach, endorsed by CISA's own roadmap guidance, is to identify your highest-risk C/C++ surface and create a phased migration plan; not to attempt a full rewrite. New features in existing C/C++ codebases can be written in Rust via FFI, incrementally shrinking the unsafe surface.
No; Go, Java, Python, C#, and Swift are all listed as memory-safe. Rust is specifically recommended for systems-level work where a garbage collector is not viable. For web services, cloud applications, and tooling, other languages on the list work fine. The key distinction is: if your software touches hardware, runs in a real-time context, or requires predictable latency, the GC languages are not appropriate replacements for C/C++. For those contexts, Rust is the only viable option among the recommended languages.
Currently, the guidance is advisory for the private sector. However, it is increasingly becoming mandatory for federal contractors through acquisition rules, and CISA's Secure by Design principles are influencing cyber insurance requirements and liability frameworks. Organizations that cannot demonstrate a memory safety strategy are beginning to face friction in federal procurement processes. The trajectory is clear: what is advisory today for private companies will become mandatory for anyone selling software to the US government within a few years.
Rust eliminates memory safety vulnerabilities in safe code. It does not prevent logic bugs, improper authentication, or other vulnerability classes. SQL injection, business logic errors, and cryptographic misuse are still possible in Rust. Memory safety is one category of bugs; a very large and severe one, but not the only one. The NSA and CISA guidance is explicit on this point: moving to Rust is not a silver bullet, it is the elimination of one large, well-understood category of vulnerabilities.
The most counterintuitive finding in the 2024–2026 adoption cycle is that the NSA and CISA recommendations have had more immediate structural effect on US government procurement and defense contracting than on Silicon Valley startups. Defense primes and federal contractors face hard contractual requirements; they must justify memory-unsafe language choices in writing or lose contract eligibility. Meanwhile, most VC-backed startups, where engineers often set the technology agenda organically, are still choosing Go or Python for velocity reasons and treating Rust as optional. The adoption pattern is almost the inverse of what most developers would predict: it is top-down from government mandates, not bottom-up from developer enthusiasm. This means the strongest near-term Rust job market is in defense-adjacent companies, not in consumer tech startups; a nuance most "learn Rust for career" articles miss entirely.
Start with a skills audit. Identify which engineers are interested in Rust and invest in structured training; bootcamp or 1:1 coaching accelerates the timeline significantly compared to self-study. Then identify your highest-risk C/C++ surface; typically network-facing parsing code; as the first rewrite target. Document the roadmap in writing, even if it spans 24 months. CISA's guidance rewards organizations that can show deliberate, documented progress; not just organizations that have already completed the transition.
The near-term effect is continued salary premium: demand is growing faster than supply. As adoption broadens over a 5–10 year horizon, the premium will compress toward the market average for equivalent-seniority roles in other languages; but Rust's complexity means the talent pool will always be smaller than Python or JavaScript, providing some persistent premium. The strongest career bet is depth: engineers who understand both Rust and the domain (embedded, networking, cryptography) will retain premium pricing longer than generalists.
Not directly in the form of grants to private companies. The incentive is indirect: federal procurement rules increasingly favor memory-safe software, creating a competitive disadvantage for organizations that do not adopt it. CISA has published guidance that insurers are beginning to use as a baseline for cyber insurance underwriting; organizations demonstrating memory safety practices may qualify for lower premiums. The DoD's CMMC (Cybersecurity Maturity Model Certification) framework is expected to incorporate memory safety requirements in future revisions.
The Linux kernel's adoption of Rust as a second implementation language is the single most significant signal of Rust's technical legitimacy for systems programming. If Linus Torvalds; known for extremely high standards and historical resistance to language additions; approved Rust, it signals that Rust is ready for the most demanding systems code in existence. Practically, it means Rust kernel modules will become increasingly common, Rust kernel developers will be in high demand, and the crate ecosystem for low-level systems work will continue maturing rapidly.
Related Glossary Terms
- Ownership: The core mechanism behind Rust's memory safety; what the NSA and CISA cite
- Borrow Checker: Enforces the rules that eliminate the memory vulnerabilities government agencies flag
- Lifetime: Ensures references never outlive the data they point to; preventing dangling pointers at compile time
Keep Reading
- Rust in the Linux Kernel: What It Means for Systems Developers
- Rust in the Windows Kernel: Microsoft's Big Bet on Rust
- How to Build MCP Servers in Rust: The 2026 Guide
Sources
- NSA: Software Memory Safety (November 2022)
- White House ONCD: Back to the Building Blocks (February 2024)
- CISA: The Case for Memory Safe Roadmaps (December 2023)
- Microsoft Security Response Center: Memory Safety (2019)
- Google: Memory safety in Android (2022)
- Linux kernel: Rust support merged (kernel 6.1)
- Rust Foundation: Google $1M donation announcement
- DARPA: TRACTOR program (Translating All C To Rust)
- CISA: Secure by Design principles (2023, updated 2024)
- Google Android Security: Memory safety vulnerabilities in Android (2022 transparency report)
