AI Security
How to Generate an SBOM From a Container Image
A practical walkthrough of how to generate an SBOM from a container image using Syft, Trivy, and Docker Scout, plus how to keep the output trustworthy.
Mar 18, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
The GPL License Explained: What It Means for Software Security
A practitioner's walkthrough of what the GPL license actually requires, why it matters for your dependency tree, and how it intersects with software security and compliance.
Mar 18, 20266 min read
AI Security
OWASP Top 10 Training: A Practical Guide for Developers
What OWASP Top 10 training actually needs to cover in 2026 now that the 2025 list has landed, plus where to find free, developer-focused courses that stick.
Mar 18, 20267 min read
AI Security
How to Secure Docker Containers: A Practical Hardening Guide
A working checklist to secure Docker containers, from non-root users and minimal base images to capability drops, read-only filesystems, and image scanning.
Mar 18, 20267 min read
AI Security
Container Network Security: How to Lock Down Pod-to-Pod Traffic
Container network security is about controlling which workloads can talk to each other and blocking the rest by default. Here is how to build that in Kubernetes and beyond.
Mar 18, 20267 min read
AI Security
AI Bill of Materials (ML-BOM) Standards in 2026
A senior engineer's survey of AI-BOM and ML-BOM standards in 2026, from CycloneDX ML components to SPDX 3.0 AI profile, and what to actually ship.
Mar 18, 20267 min read
Comparisons
A Black Duck Scan: What It Covers vs SCA Alternatives
A Black Duck scan focuses heavily on open-source license compliance and binary composition analysis — here's what it actually covers, and where modern SCA alternatives pull ahead.
Mar 18, 20266 min read
Best Practices
Continuous Compliance Monitoring: A Practical Guide for Security Teams
How to replace periodic compliance audits with continuous, automated monitoring that catches drift before auditors do.
Mar 18, 20267 min read
Compliance
DORA Third-Party ICT Risk for Financial Services 2026
A senior engineer's view of DORA third-party ICT risk in 2026: register of information, concentration risk, subcontractor depth, and the operational controls regulators actually test.
Mar 18, 20268 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.