Compliance
What does SOC 2 require for vulnerability management?
SOC 2 names no scanner, interval or deadline. CC7.1 expects you to detect new vulnerabilities and act on them. Here is what that means in practice.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
What does NIST SSDF say about developer training?
NIST SSDF task PO.2.2 asks for role based training, a periodic review of proficiency, and updates as needed. Here is what that means for a dev team.
Oct 18, 20264 min read
Compliance
What leaders assume cyber insurance covers, and what it may not
A survey found most large company CFOs expected insurers to pay most losses. The gaps between expectation and cover, and a checklist to close them.
Oct 18, 20263 min read
Compliance
What counts as a transfer under GDPR? The EDPB's three criteria
The EDPB uses three cumulative criteria to decide if processing is a transfer under Chapter V. Here they are, with the examples that matter to engineers.
Oct 18, 20264 min read
Compliance
What do banks monitor after onboarding a software vendor?
Ongoing monitoring covers finances, insurance, test results, subcontractors, security response and incidents. What to send before you are asked.
Oct 18, 20263 min read
Compliance
What auditors want from dependency scanning, and how to evaluate for it
The evidence auditors usually request about dependency scanning, and what to check in an SCA tool so you can produce it without a scramble at audit time.
Oct 18, 20263 min read
Compliance
What counts as a critical activity in bank third-party risk?
A critical activity is one that could expose a bank to significant risk if a third party fails. Here is how it changes what your software vendor is asked.
Oct 18, 20263 min read
Compliance
What an SBOM tells a risk manager, and what it cannot
An SBOM answers 'are we exposed to this flaw' and 'who made this part.' It does not say if a flaw is exploitable. What to read and what to ask next.
Oct 18, 20263 min read
Compliance
What should an AI product data flow diagram show for a buyer review?
The elements an enterprise reviewer expects in an AI product data flow diagram: data stores, model calls, trust boundaries, logs and deletion.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.