Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Instructions hidden in a web page, ticket or document can steer an AI agent. Here is what MITRE T1698 describes and how to limit what a hijacked agent can do.
App passwords let legacy clients skip MFA, and attackers want them for the same reason. See what T1697 documents and how to detect and retire them.
Some bots never trigger a CAPTCHA because they imitate a real browser. MITRE T1696.002 shows why your bot defense cannot depend on the challenge appearing.
Bots can solve CAPTCHAs with scripts, AI tools or paid human workers. MITRE T1696.001 explains why a solved challenge should never end your checks.
MITRE T1696 covers adversaries who get past CAPTCHA and bot checks. A CAPTCHA is one signal, not a gate, and this post shows how to layer the rest.
Attackers unset HISTFILE, prepend a space or change PSReadLine settings so their commands vanish. Learn the tricks, the detections and the settings that help.
Attackers push systems back to older, weaker versions such as PowerShell 2 or SMBv1. Learn what T1689 documents, how to spot it, and what to remove.
Rebooting Windows into safe mode can leave EDR switched off. Learn what T1688 covers, which BCD and registry changes to watch, and how to keep defenses running.
Attackers sometimes exploit bugs in your security tools to switch them off. Here is what MITRE T1687 documents, how to spot it, and how to shrink the exposure.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
