The 111 tech companies that signed on to the Cybersecurity Tech Accord compete against each other every day, but they all agree on the big picture: protecting their customers and users and improving cybersecurity globally.

Since Microsoft President Brad Smith launched the initiative in April 2018 with 32 companies including Facebook, Cisco, Dell Technologies, and Nokia, it has grown into what its members say is the largest industry led cybersecurity pact. It has also worked with other industry groups and endorsed cybersecurity best practices like Domain-based Message Authentication, Reporting & Conformance and Mutually Agreed Norms for Routing Security.

And the group continues to push governments to adopt similar policies that oppose cyberattacks on organizations and civilians — for example, contributing to and ultimately endorsing the Paris Call for Trust and Security in Cyberspace and working with a United Nations’ digital cooperation panel.

More recently the Cybersecurity Tech Accord members committed to adopt vulnerability disclosure policies for technology products and services. These are policies that establish transparency in security flaw reporting and mitigation. Different companies have different policies, but ultimately they aim to reduce security weaknesses that, unless fixed, malicious actors could exploit.

It’s an issue the group supported from the start and encouraged governments to endorse as well. More than half of the member companies already have such policies in place, and the rest pledged to adopt them by the end of the year.

Cloudflare is one of the original signatories, and it’s had a vulnerability disclosure policy since before the Cybersecurity Tech Accord was formed.

“There’s always going to be bugs in things, and the key is to have mechanisms to make sure they are disclosed in a responsible way so they can be addressed,” said Alissa Starzak, head of policy at Cloudflare. “You want to have a policy in place so you can take action.”

One of the Cybersecurity Tech Accord’s primary accomplishments is that it brought “a bunch of private-sector companies together to amplify concepts of protection of users and building security for the internet,” she said. “From cybersecurity companies to companies that are much more on the network side or the software side, it’s a very powerful voice.”

While the group isn’t looking to get governments to sign on to its four principles, when this many companies endorse security protocols and principles, it can encourage governments to follow suit, she added.

“The idea is if you start building norms, so much of the internet is built on the private side so it can actually lead to government norms on the public-sector side,” Starzak said. “We want to make sure we have confidence in our networks and our software. The notion is how do we make sure we build better systems and build norms consistent with having a secure internet.”

“It’s very easy from a government standpoint to work with individual companies and think that is representative of an industry as a whole,” she continued. “With the accumulation of members over time, our ability to negotiate and talk about the process on the government side grows.”