Well, now that I think of it, CERT is kind of similar. The problem is that CERT can only react to problems after they have happened. For physical products, you

Well, now that I think of it, CERT is kind of similar. The problem is that CERT can only react to problems after they have happened. For physical products, you first have to meet CE standards to even get to the market. You can give the the label to your own product if you want to take the risk, but unlike software there is an official barrier to entry. I'm not sure if it's even possible to develop similar standards for software.