AI Security
AI Agent Tool Confused Deputy Problem in 2026
A senior engineer's take on the confused deputy problem in AI agent tool use, why it keeps reappearing in 2026, and the architectural patterns that actually fix it.
Mar 14, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedThreat Intelligence
APT29 Cloud Supply Chain Tradecraft 2025
APT29's 2024-2025 cloud-native tradecraft — from Midnight Blizzard's Microsoft intrusion to the Teams phishing pivots — shows how SVR targets identity as supply chain.
Mar 14, 20267 min read
Compliance
CMMC Level 3 Software Supply Chain Checklist 2026
A senior engineer's CMMC Level 3 checklist focused on software supply chain: SBOM, SC-SR controls, SSP evidence, and the operational gaps most defense contractors still have.
Mar 14, 20268 min read
Regulatory Compliance
ISO 27001 certification: complete guide and requirements
ISO 27001 requirements explained: the 93 Annex A controls, clause structure, audit timeline, and where supply chain security controls fit into certification.
Mar 14, 20267 min read
Regulatory Compliance
FedRAMP High Supply Chain Controls in 2026
Rev 5 controls are the operative baseline, and the SR control family is where most FedRAMP High authorizations are now spending their assessor time in 2026.
Mar 14, 20265 min read
Vulnerability Research
Font File Vulnerability History: When Typography Becomes an Exploit
Font parsing has been a goldmine for attackers. The history of font vulnerabilities reveals deep supply chain risks in every operating system.
Mar 14, 20265 min read
Industry News
NIST NVD Recovery: The New Consortium Reshaping Vulnerability Data
After months of processing backlogs and community frustration, NIST announces a new consortium to modernize and sustain the National Vulnerability Database.
Mar 14, 20266 min read
Compliance
SOC 2 Type 1 vs Type 2: differences, timelines, and which...
Type 1 audits control design at a point in time; Type 2 tests operating effectiveness over months. How they differ, realistic timelines, and which to pursue first.
Mar 14, 20268 min read
Product
Reachability Analysis: Cutting Through Vulnerability Noise
Not every vulnerability in your dependencies is exploitable. Safeguard's reachability analysis determines whether vulnerable code paths are actually invoked in your application.
Mar 14, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.