AI Security
What is observability in AI models and what should you log?
AI observability means recording prompts, retrieval, tool calls, versions and costs so you can explain and audit behavior. Log traces with care.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
How do you build a Node.js MCP server that exposes data to an LLM?
Expose read-only data to an LLM through MCP resources: pick URIs, declare the capability, validate every read, and keep scopes narrow. Steps for Node.js.
Oct 18, 20265 min read
AI Security
NIST AI RMF: what does a product manager need to decide?
The NIST AI RMF is voluntary guidance: Govern, Map, Measure, Manage. Product managers decide scope, owners, risk thresholds and release gates.
Oct 18, 20264 min read
AI Security
NIST AI RMF for engineering leaders: what to decide first
The NIST AI RMF is voluntary guidance, not a certification. A VP of engineering should decide who owns AI risk, which systems are in scope and what evidence to keep.
Oct 18, 20264 min read
AI Security
NIST AI RMF for DevOps leads: Govern, Map, Measure and Manage in CI
The NIST AI RMF is voluntary guidance with four functions. A DevOps lead can wire them into pipelines: inventory, eval gates, monitoring and rollback.
Oct 18, 20264 min read
AI Security
NIST AI RMF for a first security hire: where to begin
The NIST AI RMF is a voluntary guide, not an audit. A first security hire can use it to start an AI register, set owners and write down which risks matter.
Oct 18, 20264 min read
AI Security
What is a neural network and how can it be attacked?
A neural network is layers of weighted sums that learn from data. Attackers can poison data, fool inputs or extract the model, so plan defences for each.
Oct 18, 20264 min read
AI Security
MCP tool permission design: a checklist for engineering teams
Design MCP tool permissions so a confused or hijacked agent can do little harm. Split tools by risk, scope tokens, require approval and log every call.
Oct 18, 20264 min read
AI Security
MCP server threat model: a checklist for engineering teams
A practical MCP server threat model: confused deputy, token passthrough, SSRF, session hijacking and local server risk, plus a checklist to review each.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.