vendor-risk
Safeguard articles tagged "vendor-risk" — guides, analysis, and best practices for software supply chain and application security.
25 articles
Japan METI's SBOM Guidance: What Software Vendors Need to Know
METI's SBOM guidance has no legal teeth, yet Ver. 2.0 already shapes procurement at Japan's largest manufacturers and critical-infrastructure buyers.
NYC Health + Hospitals Vendor Breach: 1.8 Million Records, Including Biometrics, Exposed (May 2026)
A months-long intrusion through a third-party vendor exposed medical records, government IDs, geolocation, and fingerprint and palm-print biometrics for at least 1.8 million people at the largest U.S. public health system. We unpack the dwell time and the third-party blast radius.
Vendor Questionnaire Fatigue And How To End It
Security questionnaires have ballooned into 400-row spreadsheets that nobody reads carefully. Here is how to replace the ritual with evidence ingestion that actually changes vendor risk decisions.
Continuous Vendor Monitoring vs Annual Review
Annual vendor reviews discover problems eleven months too late. Continuous monitoring closes the gap, but only if your TPRM tooling can ingest and normalize signals at vendor scale.
Vendor Incident Coordination In The 72-Hour Window
Most vendor incidents go badly because the first 72 hours are spent figuring out who to call. A pre-built coordination playbook turns chaos into a rehearsed response.
Agentic Procurement: Letting AI Agents Buy Software Safely
Agents can now evaluate, trial, and pay for software without a human in the loop. The controls that make that safe: spend caps, allowlists, verifiable merchants, and audit trails.
TPRM Vendor Tiering By Blast Radius Not Spend
Most TPRM programs tier vendors by spend. That misses the vendors who are cheap but catastrophic when they fail. Tiering by blast radius is the fix.
Flowing Down CMMC And CRA Clauses To Vendors
CMMC 2.0 and the EU Cyber Resilience Act both require obligations to flow down through your supply chain. Here is how to write the clauses and verify the compliance.
Introducing Safeguard TPRM: Evidence-Based Third-Party Risk Management
Safeguard's new TPRM module replaces vendor questionnaires with SBOM-driven, continuous third-party risk assessment.
Evaluating Vendor Attestations: SOC 2 / FedRAMP
A SOC 2 report does not mean the vendor is secure. Here is how to read attestations carefully, what FedRAMP actually proves, and how to ingest both at scale.
Fourth-Party Risk: The Supply Chain Of Vendors
Your vendors have vendors. Most TPRM programs stop at the third party and miss the fourth-party blast radius. Mapping the full chain is now a board-level expectation.
Automating Third-Party Risk Assessment: Moving Beyond Spreadsheets and Questionnaires
Why manual vendor risk assessments are failing, and how automation is reshaping third-party risk management for software supply chains.