AI Security
Refusal Rate Analysis: Griffin AI vs Mythos
A security AI that refuses too often is useless. One that refuses too rarely is dangerous. Griffin AI publishes calibrated refusal benchmarks; Mythos does not.
Feb 4, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCloud Security
IBM Cloud Code Engine: A Supply Chain Defender's Walkthrough
Code Engine abstracts away Kubernetes for Knative-style serverless workloads on IBM Cloud. The supply chain story is different from what most defenders bring from AWS or GCP.
Feb 4, 20268 min read
Supply Chain
Inside PyPI Project Quarantine: How the Reversible Takedown Workflow Has Performed Since Launch
PyPI's Project Quarantine status, introduced in August 2024 and used roughly 140 times in its first year, replaces irreversible deletions with a reversible hidden state. Here is how the workflow operates and how to consume the signal.
Feb 4, 20266 min read
Compliance
SEC Form 8-K Item 1.05: Two Years of Enforcement Lessons
Two years into mandatory cybersecurity incident disclosure, the SEC has issued comment letter sweeps and settled enforcement actions. Here is what filers got wrong.
Feb 4, 20266 min read
Cloud Security
Wiz vs Prisma Cloud in 2026
Two CNAPPs at the top of every shortlist, and they are not interchangeable. A detailed look at agentless coverage, runtime depth, pricing pressure, and deployment realities.
Feb 4, 20266 min read
Container Security
Container Runtime Showdown: runc vs crun vs gVisor in 2026
A practical comparison of runc, crun, and gVisor across performance, isolation, and operational fit, with concrete guidance on when each runtime earns its place in production.
Feb 4, 20265 min read
Software Supply Chain Security
Event-Stream npm 2018: Package Trust Lessons That Still Apply
The event-stream npm incident remains the cleanest case study in maintainer-handoff risk. What it taught the ecosystem, and what we still ignore in 2026.
Feb 4, 20265 min read
Best Practices
FAQ: CycloneDX vs SPDX — Which to Use?
Practical answers to the most common CycloneDX vs SPDX questions: differences, tooling, regulatory preference, VEX support, and when to emit both.
Feb 4, 20266 min read
Tutorials
Getting Started with Safeguard MCP + Claude Desktop
Connect the Safeguard MCP server to Claude Desktop so your AI assistant can scan dependencies, read SBOMs, and suggest fixes grounded in real advisory data.
Feb 4, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.