SBOM Standards
SPDX 3.0: What Changed and Why It Matters
SPDX 3.0 is a major overhaul of the ISO-standard SBOM format. Here is a practical breakdown of the new profile system, linking model, and what it means for adoption.
Feb 22, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedIncident Analysis
Sisense Data Breach: When Your Analytics Platform Becomes the Threat
CISA issued a rare advisory urging Sisense customers to reset credentials after attackers compromised the business intelligence platform, potentially accessing customer data across thousands of organizations.
Feb 22, 20265 min read
AI Security
MCP Server Registry Security Governance
MCP servers are becoming a new dependency class with their own supply chain risks. How to think about registry governance, verification, and enterprise ingestion policy.
Feb 22, 20266 min read
AI Security
Source/Sink Classification: Griffin AI vs Mythos
Taint analysis only works if sources and sinks are labeled correctly. Griffin AI uses a curated catalog; Mythos-class tools infer on the fly.
Feb 22, 20267 min read
AI Security
HIPAA Supply Chain Controls: Griffin AI vs Mythos
HIPAA's software supply chain expectations have sharpened in 2025-2026. Evidence generation is the difference between passing an audit and rerunning it.
Feb 22, 20265 min read
Privacy
Privacy Engineering in Software Supply Chains
Privacy by design cannot stop at your own code. Every dependency, every third-party service, every SDK in your supply chain is a privacy decision. Here is how to engineer privacy across the full stack.
Feb 22, 20265 min read
Industry Analysis
Rust Security Explained
Rust kills most memory-safety bugs, but crates.io supply chain attacks and CVE-2024-24576 prove "written in Rust" isn't a security guarantee.
Feb 22, 20266 min read
Compliance
Federal Software Procurement and SBOM Requirements: A Vendor's Playbook
If you sell software to the US government, SBOM requirements are now non-negotiable. Here's a practical playbook for compliance.
Feb 22, 20266 min read
Best Practices
FAQ: When Do You Need a Dedicated SBOM Tool?
When a scanner's built-in SBOM export stops being enough — signals you need a dedicated SBOM tool, what one actually does, and how to evaluate.
Feb 22, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.