vendor-management
Safeguard articles tagged "vendor-management" — guides, analysis, and best practices for software supply chain and application security.
8 articles
Every SaaS Tool Nobody Approved Still Has Access
Someone signed up with a company card, connected it with broad OAuth scopes, used it for a quarter, and stopped. The subscription lapsed. The integration did not. Adopting a tool costs nothing; removing one requires someone to remember it exists.
A Vendor Just Told You They Were Breached
The notification is vague, late, and does not say whether you are affected. It starts several clocks, and one of them may be a 72-hour regulatory deadline that runs from when you became aware, not when their investigation finishes.
The Contractor Offboarding Nobody Ever Did
Every offboarding process is triggered by a termination event in a directory. A contractor's engagement ending produces an invoice, not a directory change, so nothing downstream fires and the account stays live.
Your Subprocessor List Is Out of Date and That Is a Contract Problem
It was written for your first enterprise contract, it has three entries, and since then you added error tracking, support tooling, analytics and a model provider your product calls on every request.
The Checkmarx Logo: Where to Find It and How to Use It Correctly
Looking for the Checkmarx logo? Here is where to source an official version, how to use it without violating brand rules, and why logo hygiene matters for security teams.
Post-Incident Vendor Coordination
When a vendor's incident affects you, the coordination work between their IR team and your ops becomes its own project. How to run it well.
Third-Party Risk Management for Software Vendors
A practical TPRM program for software vendors covering intake, tiering, annual review, SBOM ingestion, and continuous monitoring with staffing ratios and budgets.
Third-Party Risk Management for Software Vendors: Beyond the Questionnaire
Security questionnaires are still how most organizations evaluate vendor risk. They're also still mostly useless. Here's what actually works.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.