Security Engineering, Ross Anderson’s textbook, argues that the hardest problem in security is no longer testing products before sale but keeping them patched for years afterwards. Six years after its third edition, Europe has written that idea into law. The book’s account of why it was needed holds up better than its hopes for how the law would work.
In November 2026 the question of how long a phone, router or car keeps receiving security fixes is no longer a niche concern. A European reporting regime for exploited product flaws has been live since September. Google and Samsung sell flagship phones with seven-year update promises. Meanwhile, state-linked attackers are still breaking into iPhones and Android handsets that simply never installed fixes that already existed. The most useful book I know for understanding why all of this is happening at once was finished in 2020.
Ross Anderson, Cambridge’s Professor of Security Engineering, who died in March 2024, published the third edition of Security Engineering: A Guide to Building Dependable Distributed Systems with Wiley (ISBN 978-1-119-64278-7). Its 29 chapters run past a thousand printed pages, and the chapters are free to download from his Cambridge page. This review draws on four of them, read for their argument about updates and incentives: Chapter 8 (Economics), Chapter 22 (Phones), Chapter 28 (Assurance and Sustainability) and the closing Chapter 29, plus the front matter. It does not assess the book’s coverage of cryptography, protocols, banking or tamper resistance, which fill most of its length.
What the book argues
The argument that matters here is stated most sharply in Chapter 28. Anderson says the field’s old model of assurance, in which a lab certifies a product once and the world relies on the certificate, has collapsed. “Assurance is no longer static,” he writes on page 1015. The Common Criteria, one of the evaluation schemes he dissects at length, belongs to a world that is “now moribund”: the idea that a device should be secure “because someone spent $100,000 getting an evaluation lab to test it five years ago would strike most people nowadays as quaint.” Page 1016 adds the harder charge, that such schemes “ended up acting as a liability shield” rather than making risk visible.
What replaces them is a world of continuous maintenance. Anderson describes two kinds of secure system that existed ten years before the book: phones and laptops, “sort-of secure because the software got patched once a month”, and cars and medical devices, which were tested to death and then left alone because patching meant a recall. Putting the second group online forces them into the first group’s world, and nobody has priced the cost (p. 1016).
The conclusion he draws, in the book’s final chapter, is blunt. Software in cars, pacemakers and substations “may have to maintain software for twenty or even forty years. We have no real idea how to do that” (p. 1060). He elevates this to a research “grand challenge” on page 1053. The summary on page 1056 is the line most worth remembering: “We’re never done, and nobody who says they are done should be trusted.”
How it is built
The structure is what makes the argument credible rather than polemical. Chapter 8 supplies the economic theory. Chapter 22 supplies the evidence from the market that most readers carry in their pockets. Chapter 28 turns both into policy. Reading them in that order is the best way to use the book.
Chapter 8 starts from Akerlof’s used-car “market for lemons”: when buyers cannot tell good from bad, the cheap product wins. Anderson applies it to security products, noting that antivirus buyers in the 1990s “would buy the $10 product rather than the $20 one” (p. 294). The same chapter traces the long dispute over how to manage patching. Early models assumed bugs were found at random, which implied that frequent disclosure and patching were wasted effort. Later data showed public disclosure made vendors fix bugs faster. Anderson’s verdict is that in the right circumstances software “can be more like wine than like milk – it improves with age” (p. 297). That sentence is the hinge of the whole sustainability argument: ageing only helps if someone keeps maintaining the product.
Chapter 22 shows what happens when nobody does. The biggest security problem with Android implementations, Anderson writes, “is poor after-sales support” (p. 765). He cites a 2015 survey finding that 87% of active devices were insecure on average over 2011–15 because they ran operating system versions with known vulnerabilities. A fix to a cryptographic library has to travel from the open-source project to Android, then to each phone maker, then to each mobile network operator, and “Each of these steps can take several months, and each can be neglected for commercial reasons” (pp. 765–766). On the other side of the market he credits Apple’s business model with a better incentive: iPhones are “typically patched for at least five years while Android products are patched for three, and often less” (p. 762).
Chapter 28 then explains why the problem outgrew phones. The EU asked Anderson and colleagues in 2015–16 what would happen to safety regulation when computers are embedded everywhere. One recommendation was that vendors should have to self-certify, for their CE mark, that products can be patched (p. 1050). He describes the political fight that followed. “Most two-year old phones don’t get patched because the OEM and the mobile network operator can’t get their act together,” he writes, so how will anyone patch “a 25-year-old Land Rover” exported to Romania (p. 1051)? The car industry did not want to be liable for software patching beyond six years. Anderson’s counter is an environmental one: the CO2 emitted making a car “is about equal to its lifetime fuel burn,” so cutting average lifespans from about 15 years to six would be unacceptable (p. 1051).
What it gets right
First, it names the real failure. Most consumer security stories are written as a flaw discovered, a patch issued, a headline. Anderson’s framing is that the patch is the easy part and the delivery chain is the problem. That description fits the current news closely. A November 2026 campaign attributed by the security firm Sekoia to APT29 compromised phones using only flaws Apple and Google had already fixed, so it worked solely on devices that had not updated (Ars Technica). Google’s own November bulletin fixes the “SMS of Death” telephony flaw only for Android 14 to 17, leaving older versions to their makers (our explainer). A crash-loop bug called GhostMap, reported by Bitdefender, has no scheduled fix at all (our analysis). These are the steps that, in the book’s words, “can be neglected for commercial reasons,” arriving as case studies.
Second, it connects incentives to engineering without excusing either. Anderson does not say vendors are careless; he says one party carries the cost of protection while another carries the risk of failure. That is a testable claim, and the regulatory history he narrates tests it: the Mirai botnet, which he says he learned of on a train back from presenting the work in Brussels, exploited Xiaomi cameras that had default passwords and software that could not be patched (p. 1052). Lobbyists blocked the first attempts at a legal response, and the 2019 consumer-law update came afterwards.
Third, it spots second-order problems that the headlines miss. Page 1053 warns that root certificates embedded in televisions will expire, leaving devices “essentially bricked” because clients, not servers, must be updated. It also notes that the end of rapid CPU gains means that “As the party winds down, we’ll have to start clearing up the trash,” citing Hennessy and Paterson’s figures: performance growth of 52% a year from 1986 to 2003, falling to 3.5% a year afterwards. The point is that a culture of treating hardware as disposable has security consequences, and the book makes it with numbers.
Where it falls short
The book is a snapshot, and some of its predictions now read differently. Anderson says the EU’s Sales of Goods Directive “will take effect from 2021” in Chapter 28 (p. 1052), while Chapter 8 gives January 2022 (p. 304). The later date is the correct one: Member States had to transpose the directive by 1 July 2021 and apply it from 1 January 2022 (EUR-Lex). It is a small slip, but a reminder that readers should check the book’s legal timelines against the sources. The directive obliges sellers to supply updates for the period a consumer “may reasonably expect.” Anderson calls it “a huge step in the right direction” and hopes “reasonable” will mean at least ten years for durable goods (pp. 1052–1053). He presents that as hope, not forecast, and the pages I read do not claim it has happened.
The same gap appears in newer rules. The EU’s smartphone ecodesign regulation, applicable since 20 June 2025, requires manufacturers to make operating-system updates available free for at least five years after a model leaves the market. But the text applies only to updates the manufacturer chooses to provide (EUR-Lex, Regulation 2023/1670). The German technology outlet heise reported that Motorola’s lawyers read it exactly that way, meaning it does not guarantee that updates will be published (heise online). That is the pattern Anderson’s own history predicts, in which vendors work to capture or hollow out the rule. But he leaves the how underspecified. Page 1055 calls for “a learning system” for cars, with accident data flowing from vendors to investigators, and the text offers no mechanism beyond saying that laws will be needed.
The book also predates the EU Cyber Resilience Act’s operative dates, which is not a fault so much as a limit on what a 2020 book can tell a 2026 reader. Since 11 September 2026, manufacturers must notify actively exploited vulnerabilities through ENISA’s single reporting platform, with an early warning within 24 hours and a full notification within 72 hours. Its main security requirements apply from 11 December 2027 (European Commission). Anderson’s recommendation of a patchability self-certification and a stronger EU security agency reads, in hindsight, like an early draft of that direction. But he could not say whether enforcement would work, and the book gives no framework for judging it.
Finally, the market has moved on from his phone numbers. Google and Samsung now promise seven years of updates on their current flagships (Android Authority; Samsung), well above the three years he described. A comparison table compiled by The Phone Shelf, an independent tracker, still lists several 2026 Motorola models at three to four years. By its tally Apple publishes no fixed number. The picture is better than in 2020 but split by tier: the premium end has caught up while cheaper devices, the ones most likely to be kept longest, may not have.
Who it is for
Chapters 8, 22 and 28 together make a short course in why consumer security fails, and they are readable without the cryptography. Journalists, product managers, procurement staff and regulators will get the most from them. Engineers will find Chapter 28’s account of how evaluation schemes turned into a liability shield useful when arguing for continuous testing over one-off certification. Casual readers should not expect a how-to-secure-your-phone guide: the book is about incentives and institutions, and its advice is aimed at those who design products and rules.
Anderson is candid that the merging of safety and security is unfinished: safety engineering, he notes, “has fragmented over time” into separate disciplines for aircraft, vehicles, medical devices and more (p. 1044). The chapters give readers a well-referenced starting point, not a finished doctrine.
How it meets the moment
The moment is one in which patching is finally a legal subject, not only a technical one, and where the first real tests are arriving. Europe has a reporting obligation in force, a longer update mandate with a drafting gap, and vendors who have set seven-year promises at the top of the market while the middle and low end lag. Anderson’s book does not tell readers what will happen next. What it gives them is the right question for each new rule: who pays for the update, and who suffers if it never comes?
That question deserves asking of the next phone launch, the next router bulletin and the next regulatory deadline. The book’s weakest point, its lack of a mechanism for turning “reasonable” into something enforceable, is also the live problem. Until a court or regulator tests what “reasonable” means for a phone sold in 2026, the gap between a seven-year promise and a legal duty will stay open.