Supply Chain Security
In-depth guides and analysis on supply chain security from the Safeguard engineering team.
100 articles
Full-Duplex Speech-to-Speech AI Explained: Audio Tokens and Labels
Full-duplex speech-to-speech AI hears and talks at once using neural codec tokens, so laughs and pauses survive. How it works and how to label AI speech.
How a VR Headset Is Made: Displays, Lenses, Tracking, Firmware, Eye Data
A VR headset pairs tiny displays and folded lenses with tracking cameras, an SoC and signed firmware. How each part is built and what eye data it keeps.
Spec-Driven Development with AI Coding Agents: Specs, Tasks, Security
Spec-driven development has an AI agent write requirements, design and task files before code. How it works, where security goes, and how to review it.
Self-Hosted S3 Object Storage for a Homelab: SigV4, Object Lock
Self-hosted S3 storage speaks the S3 API on your own disks. Learn SigV4 signing, Object Lock, replication versus erasure coding, and how to harden it.
Android Virtualization Framework and pKVM Explained: Protected VMs
Android's AVF uses the pKVM hypervisor at EL2 to run protected VMs whose memory the Android host cannot read. How pKVM, Microdroid and attestation work.
Control Flow Integrity Explained: Intel CET, Arm PAC and BTI, and CFI
Control flow integrity stops hijacked returns and indirect calls. Learn Intel CET, Arm PAC and BTI, Clang CFI, Windows CFG and how to verify them.
Linux IMA and EVM Explained: Measurement, Appraisal and Attestation
Linux IMA hashes files as they load, logs them into TPM PCR 10 and can refuse unsigned files; EVM guards their metadata. How to set up and attest both.
PKCS #11 Explained: Slots, Sessions, Mechanisms and Key Attributes
PKCS #11 is the OASIS C API, called Cryptoki, that apps use to drive HSMs and smart cards. Learn slots, sessions, mechanisms and risky key attributes.
NEC Subcontractor Breach: Osaka Metropolitan Ransomware, 77,851 Leaked
An NEC subcontractor breach led to ransomware at Osaka Metropolitan University and a 77,851 person leak at Osaka University. What happened, what to check.
ASPA Explained: RPKI Route Leak Detection and How to Deploy It
ASPA lets a network sign the list of its transit providers in the RPKI so routers can reject leaked AS paths. How it works, its limits and how to deploy it.
ASUS Router Flaws CVE-2026-93489 and CVE-2026-75775 Explained
ASUS fixed three High rated flaws in 3.0.0.6_102 router firmware on 23 Oct 2026. No exploitation is reported. Update firmware and lock down admin access.
Windows VBS Explained: VTL1, Secure Kernel, HVCI and VBS Enclaves
VBS uses the Windows hypervisor to run a secure kernel in VTL1 that the normal kernel cannot touch. Here is how HVCI, Credential Guard and enclaves use it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.