Industry Analysis
Why do two KEV statistics posts disagree about the same year?
Two KEV counts for one year can both be right: one buckets by dateAdded, the other by CVE ID year. Here is how to tell which one you are reading.
Oct 19, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedIndustry Analysis
What does the KEV notes field link to, and should you read it?
Every KEV entry in the 2026.10.16 feed had notes, each with an NVD link. Here is what else the notes point to and how to use them as primary sources.
Oct 19, 20266 min read
Industry Analysis
AI pricing and inference cost: short answers to common questions
Plain answers to ten common questions about tokens, plans, limits, caching and batch, each tied to provider documentation and linked to a deeper guide.
Oct 19, 20268 min read
Industry Analysis
Who should own RASP: the security team or platform engineering?
RASP sits in the request path of live apps, so ownership affects uptime. A practical split of duties across security, platform and application teams.
Oct 19, 20266 min read
Industry Analysis
How do you write a limitations paragraph for KEV, EPSS and OSV posts?
A limitations paragraph says what your data cannot show. Here are the specific caveats for KEV, EPSS and OSV, with wording you can adapt to your own post.
Oct 19, 20266 min read
Industry Analysis
Is an Unknown or blank field in vulnerability data the same as No?
No. In KEV, EPSS and OSV data an Unknown or missing value means not recorded. Treat it as its own category or your statistics will understate risk.
Oct 19, 20266 min read
Industry Analysis
Five engineers checked the same headline. How do you coordinate?
When security news breaks, several people check the same thing and miss others. A simple claim, split and merge routine to avoid duplicate work.
Oct 19, 20266 min read
Industry Analysis
How do I explain software supply chain attacks to my boss?
A 60 second explanation of supply chain attacks for a boss or board, plus five questions leaders should ask and a one page brief you can adapt.
Oct 19, 20268 min read
Industry Analysis
Self-hosted or hosted AI: what goes into the cost comparison?
Compare self-hosted and hosted AI by listing every cost line: hardware, utilization, people, security work and the hosted meters. A neutral worksheet.
Oct 19, 20268 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.