FAQ
In-depth guides and analysis on faq from the Safeguard engineering team.
50 articles
Vulnerability Prioritization FAQ: How to Decide What to Fix First
You can't fix everything at once. This FAQ explains how to prioritize vulnerabilities using severity, exploitation likelihood, active-exploitation evidence, and reachability.
SBOM Compliance Requirements FAQ: NTIA Elements, Formats, and Mandates
A precise FAQ on SBOM compliance in 2026 — the NTIA minimum elements, accepted formats, where SBOMs are actually mandated (federal, FDA, EU CRA), depth, VEX, and generation.
Data Residency and Security: FAQ
Where your data lives, what actually leaves your boundary, region pinning, customer-held keys, and how residency differs from sovereignty in a security platform.
Autonomous Remediation FAQ: How Self-Healing Vulnerability Fixes Work
What autonomous remediation actually means in 2026 — how the detect-fix-validate-merge loop runs without a human bottleneck, where humans stay in control, and how to roll it out safely.
AI Agents and Supply Chain Security FAQ: 2026 Answers
Answers on where AI agents meet software supply chain security — the dependencies agents pull in, hallucinated packages, MCP servers as components, AIBOMs, and how Safeguard keeps the agentic supply chain governed.
Sovereign Cloud Security: FAQ
What sovereign deployment means for software supply chain security: jurisdictional control, in-region operation, customer-held keys, foreign-access resistance, and honest limits.
Securing AI-Generated Code FAQ: What Breaks and How to Fix It in 2026
Practical answers on securing AI-generated code — the vulnerability patterns models produce, why volume defeats manual review, hallucinated dependencies, and how Safeguard scans and auto-fixes at merge time.
NIST SSDF FAQ: SP 800-218, the Four Practice Groups, and Attestation
A precise FAQ on the NIST Secure Software Development Framework in 2026 — the four practice groups, the CISA self-attestation form, EO 14028 lineage, the AI augmentation, and the evidence behind it.
CVSS, EPSS, and KEV Explained: A Prioritization FAQ
CVSS measures severity, EPSS estimates exploitation likelihood, and CISA KEV lists what is actively exploited. Here is how the three differ and how to use them together.
Auto-Fix Vulnerabilities FAQ: Patching Code and Containers Automatically
How automated vulnerability fixing works across source code and container images — direct and transitive dependencies, breaking-change safety, and where human review belongs.
Affordable SCA Tool FAQ: Real Software Composition Analysis for $1
How to get affordable software composition analysis in 2026 — what SCA should cost, why free scanners aren't really free, and how Safeguard's $1 Starter plan delivers real SCA.
False Positives in Security Scanning FAQ
Why security scanners produce so many false positives, what actually counts as one, and how reachability analysis and context reduce the noise. A practical FAQ.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.