vulnerability-management
Safeguard articles tagged "vulnerability-management" — guides, analysis, and best practices for software supply chain and application security.
689 articles
How Application Security Risk Management Actually Works in Practice
A working model for application security risk management: how to inventory assets, rate risk you can act on, prioritize by exploitability and impact, and prove the program is reducing risk.
Risk Management Applications: How to Secure the Tools You Rely On
Risk management applications concentrate your most sensitive data, which makes them a target. Here is how to think about securing the software that manages your risk.
Securing IoT device firmware supply chains
How Ripple20, Mirai, and Realtek SDK flaws exposed IoT firmware supply chains, what EU CRA and FDA SBOM rules require, and what reachability adds.
Application Security Scanning: How the Pieces Fit Together
Application security scanning spans SAST, DAST, SCA, and secrets detection. Here is what each type finds, where it fits in CI, and how to avoid alert fatigue.
NIST CVE Data Explained: How the NVD Works and Why the Backlog Matters
What NIST's role in CVE data actually is, how the NVD enriches records with CVSS and CPE, and why the 2024 analysis backlog changed how teams should consume it.
Trivy's etcd exhaustion problem and scan reliability issues
Trivy's local vulnerability database runs on etcd's own bbolt engine, and its single-writer lock and unbounded growth cause CI scans to stall or fail.
Container image scanning: how it works and best tools
A practical guide to container image scanning: how layer-by-layer CVE detection works, how Trivy stacks up, and where Safeguard adds deeper coverage.
Container security best practices checklist
A practical container security checklist covering base images, scanning limits, runtime risk, and why CVE scans like Trivy alone miss most real supply chain threats.
What Is SBOM Security, and Why Does It Matter?
SBOM security is the practice of using a software bill of materials to actually find and act on risk in your dependencies, not just to produce a compliance document.
Container escape attacks: how they happen and how to prev...
Container escapes rarely need a zero-day — privileged flags, mounted sockets, and excess capabilities do the job. Here's how they happen, real CVEs, and how to stop them.
The State of Open Source Security report (annual series)
Safeguard's annual State of Open Source Security Report finds transitive dependencies now drive most exposure, and reachability — not CVSS alone — separates mature security programs.
Vulnerability prioritization: moving beyond CVSS scores
CVSS scores flood teams with thousands of "Critical" findings, but fewer than 5% of CVEs are ever exploited. Here's how reachability and exploit data fix triage.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.