Industry Analysis
NSM-22 replaced PPD-21: what changed for infrastructure
National Security Memorandum 22, dated 30 April 2024, replaced PPD-21. What it says about sector agencies, CISA's role and minimum requirements.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedIndustry Analysis
NotPetya and the war exclusion: what Mondelez v Zurich teaches
After NotPetya an insurer called the attack an act of war and refused a claim. What was reported, what is still unknown, and how to read your own wording.
Oct 18, 20263 min read
Industry Analysis
UK NAO on government cyber resilience: legacy IT and skills
The National Audit Office's January 2025 report says UK government cyber resilience is lower than estimated and legacy IT lacks funded plans. Key findings.
Oct 18, 20263 min read
Industry Analysis
Does a listing, badge or score mean a security tool is vetted?
Six common beliefs about landscapes, badges, maturity labels and scores, checked against what each publisher says it measures and who measures it.
Oct 18, 20263 min read
Industry Analysis
Myth or fact: is the analyst Leader always the safest purchase?
Myth. A Leader label describes market-wide scores, not fit with your stack. Five common beliefs about analyst placements, checked against public sources.
Oct 18, 20263 min read
Industry Analysis
Myth: critical infrastructure is run by the government
Myth vs fact: most US critical infrastructure is privately owned. What CISA's sector pages say about ownership and why that shapes who has to act.
Oct 18, 20263 min read
Industry Analysis
Microsoft in the CISA KEV catalog: share by product and year
Microsoft accounts for 390 of 1,748 KEV entries, about 22%. A breakdown by product and year shows why the share is falling and what that does not mean.
Oct 18, 20264 min read
Industry Analysis
How do you tell if a tool consolidation worked, without ROI numbers?
Compare before and after on coverage, time to fix, noise, developer friction and effort to run. Take a baseline first and never invent savings figures.
Oct 18, 20263 min read
Industry Analysis
Making the business case for an SCA tool without invented numbers
Justify an SCA tool to leadership with your own measurements: exposure time, triage hours, customer requests and audit effort, not borrowed statistics.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.