Incident Analysis
In-depth guides and analysis on incident analysis from the Safeguard engineering team.
100 articles
What is ransomware as a service and how do you defend against it?
RaaS splits the work between developers and affiliates who run the attacks. See how the model works, why methods vary and where to start defending.
What is ransomware as a service (RaaS) and how does it work?
In ransomware as a service, a core group supplies tools while affiliates run the attacks. CISA explains why that makes defense harder and what helps.
What is pretexting and how is it different from phishing?
Pretexting is social engineering built on an invented identity or scenario. It is not the same as phishing. Learn how it works, the law and defenses.
What is multi-extortion ransomware and how do you prepare?
Multi-extortion adds data theft and other pressure to encryption, so backups alone do not end an incident. CISA guidance shows how to prepare and respond.
Malware vs ransomware: what is the difference?
Ransomware is one kind of malware. The difference is goal and timing: much malware hides, while ransomware announces itself. See how response differs.
What are examples of malicious code and how does it spread?
Malicious code includes viruses, worms, trojans and mobile code. Learn how each spreads, why categories blur, and which controls limit damage in practice.
What are living off the land (LOTL) attacks and how do you detect them?
LOTL attackers use tools already on your systems, so there is no malware file to flag. CISA guidance points to baselines, central logs and allowlisting.
What happened in the LiteLLM compromise and what should you check?
Malicious LiteLLM 1.82.7 and 1.82.8 reached PyPI on March 24, 2026. The facts sources agree on, where they differ, and a checklist to rotate and verify.
What are indicators of compromise (IOCs) and how do you use them?
Indicators of compromise are clues that a breach is underway or past. Learn the types, why they go stale fast, and how to search and act on a feed.
What goes in an incident response plan template?
A usable incident response plan has ten sections, from roles and severity levels to communication and review. Copy this outline and adapt it to your team.
What is identity threat detection and response (ITDR)?
ITDR means detecting and responding to attacks on accounts and identity systems. See the signals to watch, a constructed attack path and how to start.
What happened in the 2024 Hugging Face Spaces secrets incident?
In May 2024 Hugging Face reported unauthorized access to Spaces secrets and revoked tokens. Here is what it said, what it did and what AI teams should do.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.