Desktop security tools are useful, and they are also misunderstood. Five beliefs come up again and again: local means private, signed means safe, no findings means secure, more scanning means more safety, and a desktop app replaces the pipeline. Each is partly true, and each fails in a specific way.
Myth 1: local means private
Fact: it depends on what the tool sends. A desktop app can still upload an inventory, or code, to a service. Running on your laptop says where the interface lives, not where the data goes. Read the data handling statement. Safeguard's free scan page, for instance, states that files are parsed in the browser and never sent to a server, which is a clear statement worth looking for from any tool.
Myth 2: signed means safe
Fact: a signature says who published the file and that it was not changed afterward. It does not say the software is free of flaws. And lack of a signature is not proof of harm. Safeguard's page says its Windows builds are not yet code-signed, and gives the SmartScreen steps and checksums for that reason. Checksums and a verified source cover part of the gap.
Myth 3: no findings means secure
Fact: no findings means no known advisory matched what the tool could see. New advisories appear daily, and the tool cannot see packages it does not detect. OSV, for example, covers a defined set of ecosystems, so a package outside them would not show up. Rescan on a schedule.
Myth 4: more scanning means more safety
Fact: more scans without triage create noise, and people stop reading. A smaller set of well tuned checks beats a pile of alerts. Use known exploitation data and reachability to cut the list. See prioritising with KEV, EPSS and reachability.
Myth 5: a desktop app replaces the pipeline
Fact: a desktop app is fast feedback for one person. A pipeline is the shared record that cannot be skipped by accident. You want both. The post on where scans should run lays out the layers.
A sixth, smaller myth: installs are all equal
Not so. A per-user installer with no administrator rights, which the Safeguard page describes for Windows, touches less of the system than a machine-wide service. Always ask what the installer changes.
How to use this list
When a colleague states one of these beliefs, ask a question instead of arguing. Where does the data go? What does the signature prove? What could the scan not see? Those three questions resolve most disagreements.
Where Safeguard fits
Safeguard Desktop, the CLI and the pipeline integrations are meant to be used together. Test a manifest first with the free scan at gold.safeguard.sh/scan.
Quick check
Does a signed app mean it is safe to run?
No. A signature shows the publisher and that the file was not altered. It says nothing about flaws.
Should I still verify checksums for signed apps?
It is a cheap extra check, so yes, especially when you cannot confirm the source.
Sources
- Safeguard free scan
- Safeguard download page
- OSV, Open Source Vulnerabilities
- Microsoft Defender SmartScreen overview
Last reviewed: 19 October 2026.
