Why Are Companies Adopting Rust?
Not long ago, Rust was the language developers loved in surveys but rarely saw in production. Today it is a permanent part of the Linux kernel, a growing share of new Android system code, a component of the Windows kernel and the foundation of critical cloud infrastructure. Companies adopting Rust are not following a trend. They are responding to measurable security data, infrastructure costs and growing regulatory pressure. This article looks at why organisations are making the move and what the decision really costs.
What Rust Is, in Brief
Rust is a systems programming language that started at Mozilla, reached version 1.0 in 2015 and is now supported by the independent Rust Foundation. It sits in the same performance class as C and C++: it compiles to native machine code and does not use a garbage collector at runtime. The difference is that it catches most memory errors at compile time.
It does this through ownership and borrowing rules. Every value has a single owner, and memory is freed automatically when that owner goes out of scope. At any moment you can have either several read-only references to a piece of data or exactly one mutable reference. The part of the compiler that enforces these rules is the borrow checker. As a result, dangling pointers, use-after-free bugs and data races are rejected in safe Rust before the program ever runs.
1. Memory Safety: The Main Reason
The strongest driver for adopting Rust is security. In large C and C++ codebases, a significant share of security vulnerabilities comes from memory safety bugs. Rust aims to remove this class of bug at the root, and the effect is now visible in real data.
Android is the clearest example. In its November 2025 update, Google reported that memory safety vulnerabilities had fallen below 20 percent of all Android vulnerabilities for the first time. Google estimated vulnerability density in its Rust code at roughly 0.2 per million lines, compared with historical figures closer to 1,000 memory safety vulnerabilities per million lines of C and C++. Notably, Google did not rewrite its existing C++; it focused on writing new code in memory-safe languages, based on the observation that most vulnerabilities appear in new code.
2. Performance Without a Garbage Collector
Languages such as Java, C#, Go and JavaScript provide memory safety through garbage collection. For most business applications that is an excellent trade-off. In latency-sensitive network services, embedded devices or heavy data-processing components, however, garbage collection pauses and memory overhead can become a problem.
Because Rust enforces memory safety at compile time rather than at runtime, it offers both safety and predictable performance. A well-known example is Discord, which described on its engineering blog how moving a service from Go to Rust removed the latency spikes caused by garbage collection. Lower memory and CPU usage also translates directly into lower cloud bills.
3. Where Big Companies Use Rust
- Linux kernel: Rust support was added as an experiment in 2022. After the Kernel Maintainers Summit in Tokyo in December 2025 the experimental label was dropped; in the words of Rust for Linux lead Miguel Ojeda, the experiment is done and Rust is here to stay.
- Android: Google keeps expanding Rust in new system components and reports that Rust changes are rolled back less often and spend less time in code review than C++ changes.
- Microsoft: Windows 11 ships kernel components written in Rust, and Microsoft continues to invest in Rust tooling for drivers and kernel code.
- AWS: Firecracker, the micro-VM technology behind Lambda and Fargate, is written in Rust.
- Cloudflare: Pingora, the Rust-based proxy framework it built to replace NGINX in its network, was open-sourced in 2024.
What these examples share is that they are infrastructure layers where security and performance matter at the same time. That is exactly where Rust is strongest.
4. Regulatory and Customer Pressure
Memory safety is no longer just an engineering preference; it is a public policy topic. In June 2025, the US agencies CISA and NSA published joint guidance describing memory-safe languages as the most comprehensive mitigation for this class of vulnerability and urging software makers to plan their transition. In Europe, the Cyber Resilience Act introduces security obligations for manufacturers of digital products. It does not mandate a language, but it does require secure development practices that can be demonstrated.
Enterprise customers are asking suppliers for evidence of security, too. Writing the critical parts of a new product in a memory-safe language is becoming a strong answer to those questions.
5. Modern Tooling and Developer Satisfaction
Rust's success is as much about tooling as about the language. Cargo, its package manager and build tool, brings dependency management, testing, documentation and formatting under one standard workflow. Compiler error messages explain the problem and often suggest the fix.
Developers appreciate it: in the Stack Overflow 2025 Developer Survey, Rust was once again the most admired language, at 72 percent. For hiring and retention, that is a real advantage.
6. The Cost of a Bug
Catching a bug at compile time is far cheaper than finding it in testing, and finding it in testing is far cheaper than discovering it through a production security incident. Rust's type system and compiler checks pull errors to the very start of the development cycle. The lower rollback rate in Google's Android data is one sign of that: code works correctly the first time more often. For long-lived, critical software, this lowers the total cost of ownership.
The Downsides of Adopting Rust
Presenting Rust as the answer to everything would be misleading. Any decision should account for these costs:
- Learning curve: ownership and borrowing are challenging at first, especially for developers coming from garbage-collected languages. Team productivity dips early on.
- Compile times: large Rust projects can take noticeably longer to build than Go or interpreted languages.
- Talent pool: experienced Rust developers are harder to find than Java, C# or JavaScript developers.
- Ecosystem maturity: networking, CLI and systems libraries are strong, but some enterprise areas, such as certain ERP or reporting integrations, have fewer ready-made options.
- Unsafe code: hardware access or calls into C libraries require unsafe blocks, which still need careful review.
Should Your Company Use Rust?
The right question is not whether Rust is good, but whether Rust is the right tool for this problem. For components where performance, security and resource efficiency are critical, Rust is a strong choice. For typical business applications, such as order management screens or admin dashboards, languages with faster development cycles and broader ecosystems often make more sense.
In practice, the most effective approach is usually a mixed architecture: most business logic is built with familiar technologies, while the bottlenecks or security-critical parts are written in Rust. For a detailed look at where Rust shines, see our article on Rust use cases.
Frequently Asked Questions
Why are companies adopting Rust?
The main reasons are memory safety, high and predictable performance without a garbage collector, lower resource usage, modern tooling, and growing regulatory and customer expectations around secure software development.
Will Rust replace C++?
Not in the short term. Millions of lines of C++ will keep running. As with Google's approach in Android, companies usually write new code in Rust rather than rewriting existing code.
Is Rust hard to learn?
It is challenging at first because of ownership and borrowing. Once the concepts click, the compiler becomes a tool that helps developers by catching mistakes early.
Is software written in Rust completely secure?
No. Rust prevents most memory safety bugs, but not logic errors, broken authorisation or misconfiguration. Secure development practices and testing are still required.
Is Rust development more expensive?
Development can be slower at first while the team is learning. On the other hand, fewer production bugs, lower server costs and fewer security incidents can balance the total cost over time. The decision should depend on the lifespan and criticality of the project.
Can Rust be added to an existing project?
Yes. Rust can be added as a module to Python, Node.js or C++ projects through C-compatible interfaces or tools such as PyO3 and napi-rs, so critical parts can move to Rust without rewriting the whole system.
Which industries benefit most from adopting Rust?
Infrastructure, cloud, cybersecurity, fintech, embedded and IoT, and any domain where software runs close to hardware or handles high volumes of data with strict latency or safety requirements.
Conclusion
Companies adopting Rust are acting on concrete evidence: fewer memory safety vulnerabilities, more predictable performance, lower infrastructure costs and a clear answer to rising expectations for secure software. Rust is not a silver bullet, though; the learning curve and team capability are real costs. At Codefacture, we choose technology to fit the problem: Rust for performance and safety-critical components, and fast, maintainable stacks for business applications. If you need custom software for manufacturing, supply chain or wholesale operations, let's design the right architecture together.