Cloud Security
In-depth guides and analysis on cloud security from the Safeguard engineering team.
100 articles
Audit Entra Enterprise Apps After the ConnectWise Cloud Backup Abuse
An attacker signed in as the ConnectWise Cloud Backup app across Microsoft 365 tenants on 15 October 2026. A step by step Graph PowerShell audit for any trusted third-party app.
Block New Client Secrets in Entra Before an Attacker Adds One
In the ConnectWise app abuse, a hijacked app added client secrets to other apps for persistence. Entra app management policies can block that. Here is how to roll them out safely.
Turn On Microsoft Graph Activity Logs Before the Next App Breach
When the ConnectWise backup app was abused in October 2026, tenants without Graph activity logs couldn't see what it read. How to enable them, keep them and query them.
OpenTelemetry Autumn 2026 Advisories: Operator, Collector, Go SDK
A dozen OpenTelemetry CVEs landed between 8 September and 2 October 2026, from a ServiceMonitor token leak in the Operator to a webhook auth bypass. Here is which ones reach your pipeline.
Strimzi CVE-2026-55225: Kafka Resources Reach Other Namespaces' Secrets
Strimzi 1.0.0 and earlier lets anyone who can create a Kafka resource get Secret access in other namespaces. Fixed in 1.0.1 and 1.1.0. A StreamsHub Console token leak followed on 28 September 2026.
Entra ID Passkeys by Default: SMS and Voice MFA Retire in Feb 2027
Since 1 September 2026 Entra ID auto-enables passkeys for SMS and voice users. Microsoft-provided SMS and voice MFA retires on 1 February 2027, with no opt-out.
Entra SSPR Now Ignores Directory Phone and Email: Who Can't Reset?
From 7 September 2026 Entra self-service password reset only accepts registered authentication methods, not mobilePhone or otherMails directory attributes.
Cloud Pen Test Basics: AWS, Azure and Google Cloud Rules
What you may test in your own cloud account without asking, what always needs approval, and three CLI checks to run before a tester touches your environment.
Kubernetes Security Testing Basics for Small Teams
What a tester checks in a Kubernetes cluster, five commands to run first, and why the March 2026 ingress-nginx advisory is a good example of what a test should catch.
Give a Cloud Pen Tester a Role, Not an Access Key
How to grant a penetration tester time-limited, read-only access to your AWS account with an assumed role and external ID, and what AWS, Azure and Google Cloud each say about testing.
GitHub Actions OIDC Immutable sub Claims: Fix Your Trust Policies
Since 15 July 2026, new GitHub repositories mint OIDC tokens with owner and repo IDs in the sub claim. Here is how to update AWS trust policies before a deploy fails.
Entra Break-Glass Accounts After Mandatory MFA: A 2026 Checklist
Azure's mandatory MFA covers emergency access accounts too. Microsoft's current guidance says use a passkey (FIDO2) or certificate. Here is the checklist, with the alert query.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.