AI Security
MCP Security
MCP is standardizing how AI agents call tools, and attackers are already exploiting tool poisoning, rug pulls, and shadowing. Here's what MCP security actually requires.
Apr 17, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Security concerns of using the Node.js VM module as a sandbox
Node's vm module and vm2 were never a security boundary. Four critical CVEs and a 2023 deprecation prove why untrusted-code sandboxes need real isolation.
Apr 17, 20261 min read
AI Security
Protecting GenAI: OWASP Top 10 for LLMs
OWASP's Top 10 for LLM Applications reframes AI risk around prompt injection, data poisoning, and supply chain gaps that container-only tools like Aqua can't reach.
Apr 17, 20268 min read
AI Security
Frontier LLM Vendors Are Not Your Supply Chain Security Vendor
Coding agents from OpenAI, Anthropic, and Google are excellent tools. They are also not supply chain security platforms, and the assumption that they can replace one is already producing expensive gaps.
Apr 16, 20267 min read
AI Security
Total Cost of Ownership: Griffin AI vs Mythos
List price is the easiest number to compare and the least interesting one. TCO over three years is where Griffin AI vs Mythos-class platforms actually diverge.
Apr 16, 20265 min read
AI Security
What a Container Security Platform Should Actually Do
A container security platform has to cover images, registries, and running workloads. Here is what real coverage looks like and how to evaluate one.
Apr 16, 20266 min read
Application Security
What is Application Security (AppSec)
Application security spans SAST, SCA, secrets and container scanning. See how AppSec differs from DevSecOps, why it's now board-level, and how Safeguard prioritizes fixes.
Apr 16, 20267 min read
Supply Chain
Open Source Sustainability Is an Attack Surface Problem
Unmaintained, underfunded open source is not just a reliability risk — it is how attackers get in. The xz Utils backdoor proved that maintainer burnout is a security vulnerability with a CVE number.
Apr 16, 20266 min read
Application Security
Static Application Security Testing (SAST)
SAST scans source code for exploitable flaws before deployment. Learn how it works, how it differs from DAST/SCA, and where it falls short.
Apr 16, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.