threat-modeling
Safeguard articles tagged "threat-modeling" — guides, analysis, and best practices for software supply chain and application security.
44 articles
What Is a Security Development Model and How Do You Run One?
A security development model bakes threat modeling, code review, and testing into every stage of the SDLC instead of bolting security on at the end. Here is how the model works in practice.
Software Development Life Cycle Security: Building Security Into Every SDLC Phase
Software development life cycle security means every phase carries a security activity, not a scan bolted on at the end. Here is what belongs in each stage of the SDLC.
What Is a Product Security Assessment? A Practical Guide
A product security assessment is a structured evaluation of a product's design, code, dependencies, and deployment for exploitable weakness. Here is how to run one that finds real risk.
MITRE ATT&CK Meets SSDF: A Mapping
ATT&CK describes how adversaries operate; SSDF describes how to build software that resists them. Here's how to map adversary techniques to secure-development tasks so your threat model drives real engineering change.
A Beginner's Guide to Threat Modeling Your Build Pipeline
Your CI system is a production system with worse access controls. A first threat model of the pipeline takes one whiteboard session and usually finds something ugly.
Security Architecture Review Process: A Practical Framework
Architecture reviews catch security issues before code is written. Most organizations skip them or do them poorly. Here is a process that works.
A Taxonomy of Open Source Supply Chain Attacks
Supply chain attacks on open source come in distinct flavors. Understanding the taxonomy helps defenders prioritize controls and recognize threats before they reach production.
Threat Modeling the Software Supply Chain
Traditional threat modeling focuses on your code. Supply chain threat modeling extends to every tool, dependency, and process that touches your software. Here is how to do it systematically.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.