sbom
Safeguard articles tagged "sbom" — guides, analysis, and best practices for software supply chain and application security.
1024 articles
SPDX 3.0 Feature Overview for 2026
What changed in SPDX 3.0 and the 3.0.1 patch release: the profile model, AI and dataset profiles, serialization choices, and what to migrate first.
VEX Statements: Eliminating SBOM Noise In 2026
An SBOM without VEX is a noise machine. Here is how disciplined VEX authoring cuts vulnerability backlogs by 70-90% while improving defensibility, not weakening it.
What is Kubernetes Security
Kubernetes security spans four layers — cloud, cluster, container, code — and misconfiguration, not novel exploits, causes most real-world incidents.
NIST Cybersecurity Framework (CSF) explained
NIST CSF 2.0 added a Govern function and supply chain risk category in 2024. Here's what it requires, how Vanta maps it, and where build-level evidence closes the gap.
Kubernetes Monitoring Guide
A practical Kubernetes monitoring guide: what to track across nodes, control plane, and workloads, the tools teams use, and where monitoring alone misses supply chain risk.
SPDX 3.0.1: The Patch Release That Cleared ISO and OMG Submission
SPDX 3.0.1 was announced on December 27, 2024, bundling fixes from 3.0.0 implementation and the edits required for OMG SPDX/3.0 and ISO/IEC submission.
FedRAMP authorization process for cloud vendors
A breakdown of the FedRAMP authorization process for cloud vendors — timelines, JAB vs. agency ATOs, 3PAO testing, costs, and where GRC tools like Vanta fall short on supply chain evidence.
Safeguard 5.0: The Next Generation of Software Supply Chain Security
Safeguard 5.0 introduces Griffin AI, expanded SBOM analysis, and a redesigned policy engine. Here is what is new and why it matters for your security program.
How a Container Image Scanner Works (and Which One to Use)
A container image scanner inspects the layers, packages, and configuration inside an image to find known vulnerabilities before you ship it. Here is how the scan works and what separates a good tool from a noisy one.
AI-BOM and ML-BOM: The State of Standards in 2026
Where AI-BOM and ML-BOM specifications stand in 2026, which formats have real adoption, and what to capture today even if the standards are still in motion.
How to Generate an SBOM From a Container Image
A practical walkthrough of how to generate an SBOM from a container image using Syft, Trivy, and Docker Scout, plus how to keep the output trustworthy.
What is Cloud Native Security
Cloud native security explained: what it is, the 4C's model, real breach examples, SBOM requirements, and the tools that secure containers and Kubernetes.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.