A CISO does not need another console to log into. The useful question is which few places in Safeguard answer the questions you get asked every week: where are we exposed, what changed, what can we show a customer, and what will the board ask next.
This post walks through a working week using only what the Safeguard docs describe today. Where something depends on your plan or on an administrator switching it on, it says so.
What it is
Safeguard is a software supply chain security platform. For a CISO, the relevant surfaces are the web app at app.safeguard.sh, the Compliance area, the Trust Center, reports, and an MCP connection that lets an assistant such as Claude or ChatGPT read your Safeguard data.
The web app is chat first, so you can ask a question in plain language instead of building a filter. Voice commands are supported. The global search bar also accepts filter syntax, for example severity:critical AND reachable:true AND project:payments-service.
How to use it
Monday: ask, do not browse
Open the web app and ask what changed. Useful first questions are which critical vulnerabilities are reachable, which ones are on the CISA Known Exploited Vulnerabilities list, and which projects they sit in. Safeguard does reachability analysis, which checks whether your code actually calls the vulnerable function, so the answer is a shorter list than a raw scanner count.
If you prefer to stay in an assistant you already use, connect it to Safeguard over MCP at mcp.safeguard.sh. Your assistant acts as you, so it sees only what your Safeguard role allows. Tool calls are unlimited on every plan. A new workspace starts with six read-only tools, and an administrator turns on more one at a time.
Tuesday: check the compliance picture
Open Compliance and review the frameworks your organization has switched on. Each framework shows a readiness score. Read it correctly: the docs define it as the share of in-scope requirements that pass, based on what Safeguard can see, and say plainly that it is not an audit opinion or a certification. Next to the score, Safeguard shows how many requirements were evaluated by a scan and how many still need evidence from a person.
That second number is the useful one for a CISO. It tells you where the gap is a missing policy or access review rather than a missing patch.
Wednesday: decide who may do what
Safeguard has built-in roles, including Owner, Admin, Security Lead, Security Engineer, Developer, Auditor and Viewer. The Auditor role is read-only across audit records, findings and compliance evidence, which suits an external reviewer. Tenant admins can also switch off any client type, such as desktop, mobile, CLI, runners, IDE, browser extension, MCP clients, ChatGPT and Claude, so you decide which surfaces your people may use.
Requests and approvals follow a firm rule. Safeguard's assistant and MCP clients can prepare work, but they never approve, accept or sign off. A person makes those decisions in the app.
Thursday: control the AI
Safeguard can run as Full AI, Zero AI, or with a model you bring. Zero AI means everything works without a language model. If your policy limits where source code or findings may go, this is the setting to discuss with your administrator, together with the CLI local runner mode, which scans on the developer's machine and uploads only encrypted results.
Friday: show customers, then report
If your workspace has the Trust Center switched on, you manage it under Compliance, then Trust Center. It publishes at a slug you choose on trust.safeguard.sh. Publishing is always an explicit action. Frameworks show a status, and published controls are read live from continuous monitoring, so a failing control shows as failing without anyone republishing. Restricted documents, such as a penetration test summary, are released only through an approved access request.
For internal reporting, the compliance docs describe creating a report by choosing Reports, then Create Report, selecting a framework, scoping it with a date range, and exporting it.
Try it yourself
Pick one question you answered by email last month, for example which of our products contain a given library. Ask it in the web app chat instead, then ask the same thing through an MCP connected assistant and compare.
Click through it at your own pace, or open it full screen.
Quick check
Is a Safeguard readiness score an audit result?
No. It is Safeguard's assessment of what it can see, and it is not an audit opinion or a certification.
Can an MCP connected assistant approve a policy or a risk acceptance?
No. Assistants can prepare work, but approvals are made by a person in the app.
How does a CISO limit which Safeguard clients people use?
A tenant admin can switch off client types such as desktop, mobile, CLI, runners, IDE, browser extension and MCP clients.
