software-supply-chain-security
Safeguard articles tagged "software-supply-chain-security" — guides, analysis, and best practices for software supply chain and application security.
494 articles
How to Respond When a CVE Drops in a Package You Ship
A working playbook for the day a CVE lands in your dependency tree: confirm exposure with SBOM queries, judge real exploitability, patch or mitigate, then prove it and publish VEX.
What is Code Signing
Code signing proves who published software and that it wasn't tampered with — but SolarWinds, CCleaner, and 3CX show signed doesn't mean safe.
Hyperproof alternatives and review
Hyperproof and Sprinto automate compliance workflows, not supply chain security. Here's the concrete difference — and where Safeguard's SBOM, SAST/DAST, and scanning fit in.
FedRAMP Continuous Monitoring: What ConMon Really Involves
Authorization is the starting line. FedRAMP ConMon means monthly scans, POA&M hygiene, 30/90/180-day remediation clocks, and an annual assessment — every year, forever.
What is the SLSA Framework
SLSA defines four build integrity levels to stop supply chain tampering. Learn what each level requires, who's adopting it, and its real limits.
What is In-toto Attestation
In-toto attestation is a signed, verifiable record of how software was built. Here's how the format works, how it differs from an SBOM, and where it's used today.
SIEM tools comparison
Sprinto automates compliance evidence; Safeguard secures the software supply chain. Neither is a true SIEM — here's how to tell which problem you actually have.
What is Sigstore
Sigstore lets projects sign software with short-lived, identity-bound certificates instead of long-lived keys. Here's how Fulcio, Rekor, and Cosign actually work.
Vulnerability management and scanning tools
Sprinto automates compliance evidence collection; Safeguard scans code, dependencies, and containers directly. Here's how the two actually differ on vulnerability management.
What is Software Provenance
Software provenance proves where an artifact came from and how it was built. Learn what it is, why it matters, and how to verify it with SLSA and Sigstore.
Data loss prevention (DLP) software roundup
Sprinto automates compliance evidence; Safeguard secures the software supply chain. A clear-eyed look at what "DLP software" really means and where each tool fits.
Rekor transparency log
What is Rekor? It's the public, immutable transparency log at the heart of Sigstore that records software signing events for tamper-evident verification.