Every term. Explained properly.
Plain-English definitions of every concept Safeguard uses — reachability, SBOM, taint analysis, MCP security, SLSA, VEX, guardrails, and the rest — with the reasoning for why each matters to your security program.
Detection & Analysis
How Safeguard finds vulnerabilities, maps their reach, and decides which ones matter.
Reachability Analysis
Deciding which vulnerabilities can actually be exploited in your code — and ignoring the rest.
Taint Analysis
Tracing untrusted input from source to sink to find exploitable data flows.
Zero-Day Discovery
Finding novel vulnerabilities before they are publicly disclosed.
Call Graph
A map of which functions call which — the foundation of reachability and taint analysis.
CVE, CWE, EPSS, KEV
The four vulnerability intelligence signals you actually need to prioritise work.
Inventory & Provenance
What is running where, and who produced it.
SBOM (Software Bill of Materials)
A machine-readable inventory of every component in your software.
AI-BOM
An SBOM extended to model weights, training data, and AI runtime components.
SLSA Provenance
Signed attestations that prove how a build artifact was produced.
VEX (Vulnerability Exploitability eXchange)
Vendor statements of which CVEs actually affect which products.
CycloneDX
One of the two standard SBOM formats — security-optimised and widely adopted.
SPDX
The other standard SBOM format — ISO-approved and license-focused.
Asset Discovery
Continuous inventory of every dependency, image, AI model, and MCP server across the estate.
Policy, Gates & Enforcement
Where risky things get blocked — and how the block is auditable.
Guardrails
Pre-configured rules that stop risky changes before they merge.
Policy Enforcement
The same rule set applied at PR time, build time, admission, and runtime.
Admission Controller
The Kubernetes hook that rejects non-compliant workloads before they schedule.
Break-Glass Workflow
An audited bypass for legitimately urgent situations that would otherwise be blocked.
Drift Detection
Catching configuration that has quietly moved away from its declared state.
Fix PR
An auto-generated pull request that remediates a specific vulnerability.
Signing & Supply Chain Trust
How trust gets established and verified across the build pipeline.
Sigstore
An open-source stack for signing, verifying, and transparency-logging artifacts.
Cosign
The container-signing tool at the core of modern supply chain trust.
Dependency Confusion
An attack that exploits name collisions between internal and public package registries.
Typosquatting
Publishing malicious packages under names close to popular legitimate ones.
Zero CVE Container Images
Base images curated so none of the packaged components carry known CVEs.
AI Security
How Safeguard secures the AI layer — MCP, LLMs, and agent tool use.
Griffin AI
Safeguard's reasoning engine — turns engine output into human-reviewable findings and fix PRs.
MCP Server
A server that exposes tools to AI agents via the Model Context Protocol.
MCP Server Security
Governance, signing, scoped credentials, and audit logs for MCP servers.
AI Tool Orchestration
Giving each LLM exactly the tools it needs, with bounded privilege and audit.
Capability Scoping
Restricting what each MCP server or AI tool can actually do — even if the model asks for more.
Prompt Injection
The attack class where untrusted text in a model's context becomes a command it follows.
Eval Harness
A regression test suite for AI workflow quality, gated into release.
LLM Selection
Matching the right model family to the right security task for cost and quality.
Know the concepts. See them in action.
Each concept connects to the use cases and products where Safeguard applies it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.