Industry Analysis
SBOM as a Product, Not a Checkbox
Most SBOMs are generated, filed, and forgotten. Treating them as compliance artifacts rather than operational products is why they have not paid off — and how to fix it.
Feb 5, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedVulnerability Management
Vulnerability Management Automation in 2026: Beyond Scanning
Modern vulnerability management is shifting from periodic scanning to continuous, automated triage and remediation. Here's what that looks like in practice.
Feb 5, 20266 min read
Application Security
What is Risk-Based Vulnerability Prioritization
CVSS alone can't sort 40,000 CVEs a year. Learn how reachability, EPSS, and KEV data cut real risk from noise.
Feb 5, 20266 min read
Code Security
Insecure Deserialization: Why Untrusted Data Should Never Become Objects
Deserialization vulnerabilities turn data into code execution. Here is how they work, which languages are most affected, and how to defend against them.
Feb 5, 20266 min read
Cloud Security
AWS ECR Signing Policies with Notation
ECR now supports Notation-based image signing and trust policy enforcement. Here is how to design signing policies that survive scale and auditors.
Feb 5, 20267 min read
Supply Chain Attacks
Cargo supply chain attacks: typosquatting and malicious c...
Crates.io typosquatting tricks Rust developers into pulling malicious crates instead of trusted ones. Here's how these attacks work — and how to spot them before you build.
Feb 5, 20267 min read
Research
Abandoned Dependency Risk Study
The Safeguard Research team measured how much abandonment exists in real dependency graphs, how it correlates with risk, and what to do about it.
Feb 5, 20267 min read
Incident Response
Incident Response Tabletop Exercises: A Practical Guide for Supply Chain Scenarios
Your incident response plan is untested until people have walked through it under pressure. Here is how to design and run tabletop exercises that actually prepare your team for supply chain compromises.
Feb 5, 20265 min read
Vulnerability Analysis
curl CVE-2023-38545: The Worst curl Vulnerability in Years
A heap buffer overflow in curl's SOCKS5 proxy handshake earned a severity rating of HIGH from curl's creator Daniel Stenberg, who called it the worst curl flaw in a long time.
Feb 5, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.