Topic

Best Practices

In-depth guides and analysis on best practices from the Safeguard engineering team.

252 articles

Vendor Questionnaire Fatigue And How To End It

Security questionnaires have ballooned into 400-row spreadsheets that nobody reads carefully. Here is how to replace the ritual with evidence ingestion that actually changes vendor risk decisions.

Apr 12, 20267 min read

Best Practices

You Cannot Secure What You Cannot See: Asset Discovery

Most breaches start with an asset nobody remembered owning. Continuous asset discovery is the foundation that every other control depends on.

Apr 12, 20267 min read

Best Practices

SecOps Runbook: Supply Chain Incident Response

A practical runbook for supply chain incidents that turns chaos into ordered phases, with concrete artifacts, decision points, and Safeguard tooling at every step.

Apr 11, 20266 min read

Best Practices

Phased Policy Rollout: Warn To Block In Six Weeks

Hard-blocking a new policy on day one breaks builds and trust. A phased rollout from warn to block earns the right to enforce by proving the policy is correct first.

Apr 9, 20267 min read

Best Practices

Open Source vs Commercial Security Scanners 2026

When to use Trivy, Grype, and OSV-Scanner versus commercial scanners in 2026: honest tradeoffs, integration realities, and decision criteria.

Apr 9, 20268 min read

Best Practices

Continuous Vendor Monitoring vs Annual Review

Annual vendor reviews discover problems eleven months too late. Continuous monitoring closes the gap, but only if your TPRM tooling can ingest and normalize signals at vendor scale.

Apr 8, 20267 min read

Best Practices

Discovering Shadow AI Models In Production

Engineers ship models faster than security can track them. Here is how to find shadow AI in production without slowing the teams that build it.

Apr 8, 20267 min read

Best Practices

A Security Baseline for AI Agent Tool Use in 2026

Tool-using agents are now in production at most large organizations. The security baseline that should be table stakes, and what teams are still missing.

Apr 8, 20266 min read

Best Practices

Metrics Program For Supply Chain SecOps

Most supply chain SecOps metrics measure activity instead of outcomes. Here is how to design a metrics program that survives leadership scrutiny and changes behavior.

Apr 7, 20266 min read

Best Practices

Kubernetes Admission Policy For Supply Chain

Admission control is the last cheap chance to refuse a non-compliant workload. The right policies turn supply chain attestations into deploy-time decisions.

Apr 5, 20267 min read

Best Practices

Inventory Of MCP Servers: Enterprise Program

MCP servers proliferate faster than governance can track them. Build an inventory program that captures every server, tool, and consumer agent.

Apr 4, 20267 min read

Best Practices

Prioritising CVE Patches With Reachability, Not CVSS Alone

CVSS by itself produces a queue ordered by hypothetical severity. Reachability orders by actual exposure. Mixing the two correctly is where mature programs land.

Apr 4, 20263 min read