Vulnerability Management
CVSS 4.0 Scoring Adoption: What Changed
Two years after CVSS 4.0's release, adoption remains uneven. Here is where scoring really changed, where it did not, and how to handle mixed datasets.
Jun 30, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedVulnerability Management
VEX Adoption in the Enterprise: Lessons From Early Adopters
Vulnerability Exploitability eXchange documents promise to reduce alert fatigue by distinguishing exploitable vulnerabilities from theoretical ones. Here is how enterprises are actually using them.
Jun 20, 20267 min read
Vulnerability Management
Reachability-based vulnerability prioritization (Polaris ...
Reachability analysis cuts CVE noise by confirming which vulnerabilities are exploitable. Here's how Black Duck's Polaris reachability compares to Safeguard's pipeline-native approach.
Jun 15, 20268 min read
Vulnerability Management
AppSec program consolidation: reducing tool sprawl
AppSec tool sprawl is a consolidation problem, not just a vendor-count problem. A look at Black Duck's product lineage versus Safeguard's unified scanning pipeline.
Jun 13, 20268 min read
Vulnerability Management
Vulnerability scanning tools and techniques compared
A verifiable comparison of Safeguard and JFrog Xray on scan coverage, data sourcing, reachability analysis, and CI/CD integration for vulnerability scanning.
Jun 1, 20268 min read
Vulnerability Management
CVE Numbering Authority (CNA) status: why it matters when...
JFrog has issued its own CVEs since 2021 as a CVE Numbering Authority. Here's what CNA status really controls, where it falls short, and how to verify vendor-disclosed vulnerabilities.
May 29, 20267 min read
Vulnerability Management
CVE explained: how vulnerabilities get identified and scored
A CVE ID and its CVSS score come from different organizations entirely. Here's how identification and severity scoring actually work, using Log4Shell and the 2024 NVD backlog as examples.
May 27, 20267 min read
Vulnerability Management
CVSS scoring explained, and where severity scores go wrong
CVSS score explained through a real case where CVSS, EPSS, and KEV disagreed, showing why severity alone misleads prioritization decisions.
May 27, 20268 min read
Vulnerability Management
Citrix Bleed 2: Analysis and Mitigation
CVE-2025-5777 revived the memory-leak pattern that broke NetScaler in 2023. Here is what the 2025 variant does, who is exploiting it, and how to respond.
May 26, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.