AI Security
AI governance myths vs facts
Seven common AI governance myths checked against the NIST AI RMF and federal guidance: certification, bans, checklists, one-time reviews and more.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
AI governance in the first 30 days for a small team
A 30-day plan for a small company starting AI governance: inventory, policy, owners, tiers, vendor checks and a first review, without a big program.
Oct 18, 20263 min read
AI Security
AI generated code in due diligence: what buyers now ask
Buyers increasingly ask how much code comes from AI assistants and how it is reviewed. Questions to expect and a policy that gives a straight answer.
Oct 18, 20263 min read
AI Security
AI evals vs red teaming: what is the difference?
Evals measure behaviour on fixed test sets and repeat cheaply. Red teaming hunts for new failures with an adversary mindset. Why you need both.
Oct 18, 20263 min read
AI Security
AI drafted questionnaire answers: rules for safe use
AI can speed up security questionnaires, but wrong answers become commitments. Rules for source material, human review and what never to auto send.
Oct 18, 20263 min read
AI Security
AI agent memory poisoning and how memory hardening works
Persistent memory lets an injected instruction outlive one chat. What ATLAS says about memory and thread poisoning, and the four hardening controls.
Oct 18, 20264 min read
AI Security
Agent output handling: treat the model like any other user
Model output can carry XSS, SQL and shell payloads into your backend. OWASP's zero-trust advice: validate, encode and parameterize before anything runs.
Oct 18, 20263 min read
AI Security
Agent delegation vs impersonation: what RFC 8693 distinguishes
When an AI agent acts for a user, should it impersonate them or act as a delegate? RFC 8693 defines both and the actor claim that records who did what.
Oct 18, 20263 min read
AI Security
What to log for every AI agent tool call
A field list for agent tool call audit logs, drawn from MCP guidance on logging, delegation and elevation, so incidents can be reconstructed afterward.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.