Infrastructure Security
In-depth guides and analysis on infrastructure security from the Safeguard engineering team.
64 articles
A Revocation Is Not Effective Until Every Cache Agrees
You remove a vendor's IP from an allowlist and the firewall updates immediately. It does not update every client that already resolved the hostname and cached the answer, some of which will keep connecting to the old address for as long as their TTL says they may.
Your Staging Environment Is on the Internet and Nobody Chose That
Less hardening, unfinished code, no monitoring, real credentials, and often production's network reachability. An attacker choosing between your two environments will frequently prefer this one.
The System Nobody Touches Is Unpatched by Default, Not by Decision
It works, it matters, the person who built it has left, and everyone has agreed without discussing it that touching it is riskier than leaving it. That agreement gets more expensive every month.
Nobody Notices When a Scheduled Job Stops Running
They run at three in the morning with broad credentials, unattended, and failure produces nothing because the output was always invisible. A retention job that silently stops means you are keeping data you promised to delete.
Time Is a Security Dependency Nobody Declares
Clocks disagree, and things expire. Both produce outages that look like security failures, both are entirely predictable, and both are usually discovered by a customer.
Your Health and Metrics Endpoints Describe Your System to Anyone Who Asks
Nobody designed them. A framework, a platform team or a monitoring integration added them, they were configured once, and they are the endpoints that describe your architecture most accurately.
The Agents on Your Hosts Have More Access Than Your Application
Four agents on every production host, each running as root or with kernel privileges, each auto-updating from its vendor, each sending data outward. Your application dependencies are pinned and scanned. These are neither.
The Domains You Registered Defensively Can Send Mail As You
You configured SPF, DKIM and DMARC on the domain you send from. The eleven others you own have no email authentication at all, and the ones closest to your real name are the most useful to an attacker.
A Half-Deleted Service Is More Dangerous Than a Running One
Services are launched with a checklist and switched off with a Slack message. The container goes, the credentials stay, and nobody patches or monitors something everyone believes is gone.
The Subdomain You Forgot Is Someone Else's Now
A CNAME outlives the vendor account it pointed at, the platform frees the hostname, and anyone can claim it. The damage is rarely the defaced page: it is parent-domain cookies, OAuth redirects and a CSP that trusts subdomains.
What Actually Breaks When You Scan Without Internet Access
Every dependency scanner is a program that looks things up. The six things it needs a network for, the four operating models people all call air-gapped, and the questions to ask before a proof of concept.
The Shard Ceiling Turns Failed Writes Into Empty Reads
A search cluster at its shard limit stops creating indices. The read path cannot tell a missing index from no matching documents, so both return an empty list with a 200. Dashboards show zero and nothing pages.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.