Container Security
Image Scanning
How container image scanning works, where tools like Aqua Security's Trivy fall short on noise and reachability, and what modern scanning workflows require.
Apr 16, 20268 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
How Does SAST Work? Stages of SAST Scanning
A stage-by-stage breakdown of how SAST scanning actually works — parsing, taint analysis, false positives — with real CVEs and benchmark data.
Apr 16, 20267 min read
Container Security
Container Registry Scanning
How container registry scanning actually works, why Aqua's Trivy isn't enough on its own, what the xz-utils backdoor exposed, and how Safeguard prioritizes findings that matter.
Apr 16, 20268 min read
Application Security
Dynamic Application Security Testing (DAST)
DAST tests running apps like an attacker would. Learn how it works, what it catches and misses, and how PCI DSS 4.0 now mandates it.
Apr 16, 20267 min read
Container Security
Docker CIS Benchmark
A practical breakdown of the Docker CIS Benchmark's 100+ controls, the checks teams fail most, how Aqua Security handles compliance, and what audit failures actually cost.
Apr 16, 20267 min read
AI Security
AI-Driven Security: What It Actually Does for Application Security
AI-driven security is more than a buzzword bolted onto old scanners. Here's where machine learning genuinely helps triage, reachability, and detection — and where it quietly hurts.
Apr 15, 20266 min read
Open Source Security
OpenSSF's Maintainer Handoff Governance: From Burnout-Driven Sabotage to Structured Repository Transfer
After colors.js, event-stream, and the colors-faker sabotage incidents, the OpenSSF Securing Software Repositories WG drafted guidance for when registries should allow ownership transfer of long-standing projects. Here is the defender view.
Apr 15, 20266 min read
Compliance
TSA Surface Transportation Cyber NPRM: From Directives to Rule
TSA's November 2024 Enhancing Surface Cyber Risk Management NPRM would formalize what pipeline and rail SDs already require. Operators should prepare now.
Apr 15, 20266 min read
AI Security
MCP Meaning: What the Model Context Protocol Is and Why It Matters
The MCP meaning most people are asking about is the Model Context Protocol, an open standard that lets AI models connect to tools and data through one common interface.
Apr 15, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.