Security Guides
How often should you run SAST, DAST and SCA?
Run SAST and SCA on every pull request, SCA monitoring daily, and DAST on release candidates plus a regular schedule. A cadence table with reasons.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How often should you rescan container images that are already deployed?
An image that was clean at build can be vulnerable next week. Here is how often to rescan deployed images, what triggers a rescan, and what to automate.
Oct 18, 20263 min read
Security Guides
How often should you update a threat model?
Update a threat model when the design changes, not on a fixed calendar alone. Triggers, a light review rhythm and how to spot a stale model.
Oct 18, 20263 min read
Security Guides
How often should you scan hundreds of services?
Scan on every change, on a schedule, and when advisories land. How to combine the three triggers for a large service fleet without drowning pipelines.
Oct 18, 20263 min read
Security Guides
How often should you scan dependencies for vulnerabilities?
Scan on every pull request, rescan stored inventories daily, and review weekly. Here is why each cadence exists and what scanning less often costs you.
Oct 18, 20263 min read
Security Guides
How much test coverage do you need before enabling automatic fix PRs?
There is no magic coverage percentage. Judge by whether your tests would catch a broken upgrade. A quick test to run before enabling fix PRs.
Oct 18, 20263 min read
Security Guides
How much engineer time does running open source scanners take?
How much engineer time open source scanners really take: setup, upkeep, triage and reporting, with a worksheet to estimate your own numbers honestly.
Oct 18, 20264 min read
Security Guides
How many services do we run? Build a service inventory in a week
How to build a service inventory for vulnerability scanning: five data sources to merge, fields to record, and how to find the services nobody listed.
Oct 18, 20264 min read
Security Guides
How many security champions does an engineering team need?
Aim for one champion per delivery team, not a ratio of headcount. Here is how to size the program, who to pick and when to add a second person.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.