SBOM
SBOM 101: A Complete Beginner's Guide to Software Bill of Materials
Everything you need to know about Software Bills of Materials -- what they are, why they matter, and how to start generating them for your projects.
Jan 9, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedHardware Security
Hardware Supply Chain Trust Boundaries
Hardware travels through dozens of hands before reaching your data center. Understanding and enforcing trust boundaries across the hardware supply chain is essential for building secure systems.
Jan 9, 20266 min read
Vulnerability Analysis
Confluence Zero-Day (CVE-2022-26134): Atlassian's OGNL Injection Crisis
An unauthenticated RCE zero-day in Confluence Server was being actively exploited before Atlassian even knew about it. The vulnerability affected virtually every on-premise Confluence installation.
Jan 9, 20265 min read
DevSecOps
Software Provenance Tracking: From Source to Production
Software provenance answers the question: where did this code come from, who built it, and can I trust it? In 2022, provenance tracking moved from academic concept to practical necessity.
Jan 9, 20266 min read
Dependency Management
Evaluating Open Source Alternatives Through a Security Lens
When choosing between open source packages that provide the same functionality, security factors should weigh as heavily as features. Here is a practical evaluation framework.
Jan 9, 20265 min read
Incident Analysis
Synnovis NHS Qilin Ransomware: Pathology Supply Chain Lessons
Eighteen months after Qilin encrypted Synnovis, the pathology provider finally finished notifying NHS trusts. We unpack how a single supplier paralysed London hospitals and how defenders can prepare.
Jan 9, 20267 min read
AI Security
Griffin AI vs Raw Claude for Security Workflow
Griffin AI runs on Anthropic's Claude models under the hood. Here's what the engine context, eval harness, and workflow scaffolding actually buy you over calling Claude directly.
Jan 9, 20266 min read
AI Security
SSDF Attestation: Griffin AI vs Mythos
The NIST SSDF attestation form asks structured questions with structured answers. A chat transcript is not an answer. We explain how Griffin AI produces the evidence auditors expect, and why Mythos-class tools struggle.
Jan 9, 20267 min read
AI Security
CyberSecEval Reviewed: What It Measures
A working engineer's review of CyberSecEval, the Meta-originated benchmark that has quietly become the default sniff test for AI-for-security claims. What it actually measures, what it misses, and how to read its scores without fooling yourself.
Jan 9, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.