World Solve

Many connected devices become permanently vulnerable once their manufacturer stops issuing security updates, yet the devices often remain in active use for years afterward. A sustainable way to keep abandoned devices secure remains unresolved.

Malicious browser extensions can steal data or hijack sessions while appearing legitimate in official extension stores, and current vetting processes don't catch every harmful case before it reaches users. Strengthening this screening process remains an ongoing security challenge.

As cities adopt more connected infrastructure for traffic lights, utilities, and public services, the potential attack surface for disruptive cyberattacks grows correspondingly. Comprehensive security for these interconnected systems remains inconsistently implemented.

Advanced surveillance technology developed for legitimate security purposes can end up being sold to and misused by governments to suppress dissent. Preventing this kind of misuse through export controls or corporate accountability remains inconsistently enforced.

Implanted medical devices like pacemakers increasingly connect wirelessly for monitoring, but security protections for these devices haven't kept pace with the sensitivity of what's at stake if they're compromised. Closing this gap remains an urgent but underaddressed challenge.

Consumer drones have become cheap and widely available, but affordable detection systems for identifying unauthorized or suspicious drone activity in sensitive areas remain limited. Closing this security gap remains an unresolved technical and regulatory challenge.

When one website's user database is breached, attackers often successfully reuse those same stolen credentials on other unrelated websites where people reused the same password. Preventing this cascade of breaches remains an ongoing security challenge despite widespread password reuse warnings.

Companies sometimes stop providing security patches for older but still commonly used software or devices, leaving users vulnerable without clear warning. Establishing consistent, enforced support timelines remains an unresolved industry practice.

Attackers can sometimes convince phone carriers to transfer a victim's number to a new device, bypassing two-factor authentication tied to that number. Carriers have improved verification, but this attack method remains an ongoing security gap.

Ensuring software works well with assistive technologies is often treated as a lower priority than testing for basic functionality or security, leading to inconsistent accessibility even in otherwise well-built products. Making accessibility testing equally rigorous by default remains unresolved.

Some of the internet's most widely used open-source components are maintained by very few volunteers, and serious vulnerabilities have been found lurking undetected for years in code millions of systems depend on. Better resourcing and review processes for open-source security remain inconsistently funded.

Pirated or counterfeit software remains a common vector for malware distribution, and current detection and prevention methods haven't fully closed this persistent security gap. This continues to put both individual users and organizations at unnecessary risk.

Insurers offering cybersecurity coverage often struggle to accurately assess a company's true risk level, leading to mispriced policies that either overcharge safe companies or undercharge vulnerable ones. Better, more accurate risk assessment tools remain underdeveloped.

Low-code and no-code platforms have made software creation more accessible, but users without security expertise can still inadvertently build applications with serious vulnerabilities. Making these tools both accessible and inherently safe remains an unresolved design challenge.

As AI-generated faces and voices become more realistic, some biometric security systems can potentially be fooled by convincing synthetic versions of a real person's face or voice. Strengthening these systems against this emerging threat remains an active challenge.

Automatically applying every software update reduces security risk but occasionally introduces new bugs or incompatibilities, while manual review introduces dangerous delays. Balancing these risks reliably remains an unresolved operational challenge.

Small businesses are frequent targets for cyberattacks but often lack the budget or expertise to implement strong security measures. Closing this protection gap remains an unresolved challenge for a huge share of the global economy.

Advanced spyware can be installed on phones without any visible sign, and even security experts sometimes struggle to detect its presence through standard tools. Better, more accessible detection methods remain an urgent unmet need.

Digital voting could make elections faster and more accessible, but security concerns and lack of public trust have kept most large-scale elections reliant on paper-based or hybrid systems. A truly trusted digital alternative remains unbuilt.

Researchers have shown that inaudible or disguised audio signals can sometimes trigger voice assistants to take unintended actions without the user's knowledge. Fully closing this security gap remains unresolved.