Global organizations, including CISA, the NSA, and Google, are increasingly advocating for a transition to memory-safe programming languages. Official reports highlight that traditional secure coding practices and external analysis tools have failed to eliminate vulnerabilities inherent in C and C++.
Data from Google Project Zero indicates that 75% of vulnerabilities exploited in real-world attacks are memory-related. Similarly, historical analysis of Microsoft products from 2006 to 2018 shows that approximately 70% of vulnerabilities were tied to memory safety issues.
Google's implementation of Rust in Android has yielded significant results. In 2025, the share of memory-related vulnerabilities in Android dropped below 20%. The company reports a 1000-fold reduction in memory vulnerability density in Rust code compared to C and C++.
Engineering efficiency metrics also favor Rust. According to DORA methodology, Rust code requires approximately 25% less time for code reviews and involves 20% fewer revisions. Additionally, the rollback rate for Rust is roughly 4 times lower than for C++.
Despite these gains, organizations face challenges. The 2025 State of Rust Survey notes that 41.6% of developers find Rust difficult to learn, while 27.3% cite slow compilation as a primary issue. Interoperability with existing C++ codebases remains a significant hurdle.
