Security Guides
Ranking exposed assets with the CISA KEV catalog
How to use CISA's Known Exploited Vulnerabilities catalog to decide which internet-facing assets to fix first, and the limits of relying on it alone.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Use incidents to shape a security roadmap without whiplash
After an incident the roadmap wants to swerve. Sort lessons into causes, gaps and noise, fund the causes, and keep the rest of the plan intact.
Oct 18, 20264 min read
Security Guides
Using EPSS and KEV to set patch priority tiers without overtrusting
KEV says exploitation has been seen. EPSS estimates the chance in the next 30 days. Here is how to turn both into SLA tiers and where they fall short.
Oct 18, 20263 min read
Security Guides
The urgent request from the CEO: a verification rule for small teams
Fake messages from founders asking for payments, gift cards or logins hit small teams hardest. A simple verification rule that works without slowing work.
Oct 18, 20263 min read
Security Guides
Uptane full vs partial verification: which control units need which
Uptane lets small control units use partial verification while primaries must do full verification. See what each checks and how to decide per unit.
Oct 18, 20263 min read
Security Guides
API10 unsafe consumption: treat third-party API data as untrusted
OWASP API10:2023 warns against trusting data from partner and vendor APIs. Learn the three failure patterns and the checks that prevent them.
Oct 18, 20263 min read
Security Guides
Unpatchable assets: how to reduce risk when you cannot update
Some systems cannot be patched because the vendor stopped shipping fixes or downtime is not allowed. Here is how NIST suggests managing that risk.
Oct 18, 20263 min read
Security Guides
Unbranded streaming boxes: warning signs from the FBI BADBOX alert
The FBI warned that some cheap streaming boxes and other IoT devices ship infected. The warning signs it lists, and what to do if you own one.
Oct 18, 20264 min read
Security Guides
Ukraine 2015 grid attack: a lessons checklist for operators
A step by step reading of the 2015 Ukraine grid attack as CISA describes it, turned into a checklist of controls an operator or vendor can test today.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.