Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
OWASP LLM04 maps itself to no regulation, so here is a working map to EU AI Act Articles 10 and 15, NIST AI RMF and MITRE ATLAS, plus evidence to keep.
OWASP LLM02 covers PII, secrets and business data leaking through model output. A defensive test plan with canary data, role checks and log reviews.
OWASP LLM02 says sanitize data, limit access and set clear policies. A system prompt rule alone fails. Here is what to put in place first and why.
OWASP lists prompt injection as LLM01. See the direct and indirect types, documented examples and the layered defenses that reduce the damage.
Log inputs with their source, tool calls with arguments, approvals and refusals. Alert on tool use that does not match the task. A defensive LLM01 list.
OWASP LLM06 warns about agents with too many tools, permissions or autonomy. Log every tool call and approval, and alert on scope, volume and denials.
Public benchmarks will not tell you if a model helps your security team. Build evals from your own tasks, score false positives and rerun on every change.
AI assistants add two insider paths: staff pasting sensitive data in, and assistants acting with a user's access. Limit data, permissions and autonomy.
AI assistants make it easy to paste, index and send data no one meant to share. Seven common mistakes and the controls OWASP and CISA guidance point to.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
