Many organizations, including federal agencies, are already starting to ask whether their technology products are "secure by design."