Application Security
In-depth guides and analysis on application security from the Safeguard engineering team.
100 articles
What is server virtualization and how do you secure it?
Server virtualization runs many virtual machines on one host through a hypervisor. Secure the hypervisor, management plane, guests and snapshots first.
What is runtime application self-protection (RASP) and when does it fit?
RASP runs inside an application and blocks attacks using runtime context. See how it differs from a firewall and IAST, its modes and what to test first.
What is risk based vulnerability management in application security?
Risk based vulnerability management ranks findings by exploitation evidence, reachability and exposure, not severity alone. Here is how to run it on code.
What is responsible disclosure and how does it work?
Responsible disclosure means reporting a flaw privately so the owner can fix it before details go public. Learn the process, timelines and setup steps.
What is passwordless authentication and is it actually safer?
Passwordless sign-in replaces shared secrets with public key credentials such as passkeys. Learn why it resists phishing and where it can still fail.
What is MAST (mobile application security testing) and how is it done?
MAST tests mobile apps for security flaws using static, dynamic and network analysis, measured against OWASP MASVS. Learn the steps and what each finds.
What is machine identity and why are certificate lifetimes shrinking?
Machine identity is how software, servers and services prove who they are. See the main kinds, the public TLS certificate lifetime schedule and what to do.
What is federated identity and how does it work?
Federated identity lets one trusted provider vouch for a user to many separate services. Learn how SAML and OpenID Connect do it, and the risks.
What is external attack surface management and how do you do it?
EASM is the routine of finding every internet facing asset you own and fixing what is exposed. A weekly discovery loop based on NIST and CISA guidance.
What is CVSS and how should you read a score?
CVSS rates how severe a vulnerability is, not how risky it is for you. How the four metric groups work in version 4.0 and how to use scores sensibly.
What is CICD-SEC-6, insufficient credential hygiene, in pipelines?
CICD-SEC-6 covers secrets leaked in code, logs and image layers, plus broad credentials that never rotate. Here are the five failure modes and fixes.
What is certificate pinning and should you use it?
Certificate pinning ties an app to expected certificates or keys. It blocks rogue CAs but causes outages, so most teams should skip it or plan carefully.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.